ESBD_383080_1731698258221_EXHIBIT H - Business Associate Agreement.pdf

Exhibit H

BUSINESS ASSOCIATE AGREEMENT

For purposes of this Attachment, Central Health is referred to as “Covered Entity” and Contractor is referred to as “Business Associate.” Central Health and Contractor are collectively referred to as the “parties,” and any reference in this Attachment to the “Service Agreement” means the Agreement for Consulting Services between the parties.

1. OBLIGATIONS

1.1. In the course of performing the services contemplated by the Service Agreement, Business Associate acknowledges and agrees that it will create, receive, maintain, or transmit information that is protected by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Insurance Technology for Economic and Clinical Health Act of 2009 (“HITECH Act”), and current and future regulations promulgated under HIPAA and/or the HITECH Act, as well as Texas laws related to the privacy and security of health information, including, but not limited to, Texas Health and Safety Code Chapters 181 and 182.

1.2. To the extent that Business Associate uses, discloses, maintains, or transmits protected health information (“PHI”) that concerns alcohol and substance abuse treatment, Business Associate acknowledges and agrees that:

(i) such information is protected by 42 C.F.R. Part 2 (“Part 2”), and Business Associate is bound by these regulations;

(ii) Part 2 prohibits Business Associate from further disclosing such information unless disclosure is authorized by Part 2, Subparts D or E, or Business Associate obtains the written consent of the individual whose PHI is to be further disclosed; and

(iii) if necessary, Business Associate will resist any effort to obtain access to such information by initiating judicial proceedings against the person or entity attempting to gain access in contravention of Part 2.

1.3. Obligations of Business Associate and Business Associate Subcontractors. Business Associate agrees (and its Subcontractors will agree through the execution of a written contract) to comply with all of the provisions of this Section 1.3. For purposes of clarification, the obligations set forth in this Section shall apply to all of Business Associate’s subcontractors (as that term is defined in 45 C.F.R. 160.103) and subcontractor’s downstream subcontractors who create, receive, use, disclose, or have access to Covered Entity’s PHI. Any reference to Business Associate in this Agreement includes all of Business Associate’s subcontractors, directors, officers, employees, affiliates, agents, and representatives, as well as subcontractors’ downstream subcontractors. Business Associate expressly acknowledges and agrees that it will be liable for the actions and omissions of its subcontractor(s) and its subcontractors’ downstream subcontractors (collectively referred to as “Subcontractor” or “Subcontractors”).

1.3.1 Use Reasonable Safeguards to Secure Protected Health Information. The HITECH Act and final Omnibus Rule as published at 78 Federal Register 5566 (January 25, 2013) require Business Associate to comply with 45 C.F.R. Sections 164.308, 164.310, 164.312 and 164.316 as if Business Associate were a Covered Entity, and Business Associate agrees that it will comply with those provisions of the Security Standards for the Protection of Electronic Protected Health Information (the “Security Rule”). Business Associate acknowledges and agrees that the provisions of the Security Rule with which it must comply require Business Associate to:

(i) employ appropriate administrative and physical safeguards, consistent with the size and complexity of Business Associate’s operations, to protect the confidentiality of PHI and to prevent the use or disclosure of PHI in any manner inconsistent with the terms of this Business Associate Agreement. These safeguards will include, without limitation:

(a) implementing written policies and procedures in compliance with HIPAA, HITECH, and the Privacy and Security Rule;

(b) performing a security risk assessment; and

(c) regularly and adequately training its employees, and any

Subcontractors who will have access to PHI on the policies and procedures required by HIPAA, HITECH, their implementing regulations, and state law.

(ii) use, to the extent possible, commercially reasonable efforts to secure electronic protected health information (“EPHI”) through technical safeguards that render such EPHI unusable, unreadable and undecipherable to individuals unauthorized to acquire or otherwise have access to such EPHI. At a minimum, Business Associate will use technical safeguards that are compliant with 45 C.F.R. Section 164.312, or such later regulations or guidance promulgated by the U.S. Department of Health and Human Services (“HHS”) or issued by the National Institute for Standards and Technology (“NIST’) that concern the protection of identifiable data such as PHI.

(iii) provide Covered Entity with a copy of its written information security program before execution of this Business Associate Agreement.

1.3.2 Use and Disclose Protected Health Information for Permissible Purposes.

(i) Business Associate agrees that it will:

(a) use or disclose PHI only in connection with fulfilling its duties and obligations under this Business Associate Agreement and the Service Agreement;

(b) not use or disclose PHI other than as permitted by Section 2 of this Business Associate Agreement or as required by Section 1.3.3 of this Agreement; and

(c) not use or disclose PHI in any manner that violates applicable federal and state laws or would violate such laws if used or disclosed in such manner by Covered Entity.

(ii) Business Associate may disclose PHI that is not protected by Part 2 to Subcontractors as necessary to perform its obligations under the Service Agreement and as permitted or required by applicable federal or state law.

(iii) Under no circumstances will Business Associate:

(a) sell PHI in such a way as to violate Texas Health and Safety Code, Chapter 181.153;

(b) use or further disclose genetic information for underwriting purposes;

(c) attempt to re-identify any information in violation of Texas

Health and Safety Code Section 181.151, regardless of whether such action would be permitted if performed by the Covered Entity; or

(d) use PHI for marketing purposes in such a manner as to violate Texas Health and Safety Code Section 181.152. Before Business Associate can sell, use, or disclose PHI for marketing purposes, Business Associate must first obtain Covered Entity’s written consent.

1.3.3 Support Covered Entity in Fulfilling its Obligations. If the Business Associate maintains a Designated Record Set (as defined in 45 C.F.R. 164.501), Business Associate will support Covered Entity in a manner that enables Covered Entity to meet its obligations under 45 C.F.R. Sections 164.524, 164.526, and 164.528. To the extent that Business Associate is asked to carry out Covered Entity’s obligations under these sections, Business Associate will comply with the requirements that apply to Covered Entity in the performance of such obligations.

(i) Requests for Access (45 C.F.R. 164.524)

(a) Business Associate will provide Covered Entity with any PHI subject to an individual’s request for access within three (3) business days of Covered Entity’s written request for the same. Unless Covered Entity specifically requests otherwise, the PHI subject to the request will be forwarded in electronic form.

(b) In the event any individual requests access to PHI directly from Business Associate, Business Associate will forward such request to Covered Entity within two (2) business days. Before forwarding any PHI to Covered Entity, Business Associate will indicate in the Designated Record Set, any material it deems unavailable to the individual pursuant to 45 C.F.R. Section 164.524(a)(1).

Covered Entity will make the final determination as to the availability of the requested material.

(ii) Requests for Amendment (45 C.F.R. 164.526)

(a) Business Associate will provide Covered Entity with the PHI subject to an individual’s request for amendment within five (5) business days of Covered Entity’s written request for the same. Unless Covered Entity requests otherwise, the PHI subject to the request will be forwarded in electronic form.

(b) In the event any individual requests an amendment of PHI directly from Business Associate, Business Associate will forward such request to Covered Entity within two (2) business days. Before forwarding any PHI to Covered Entity, Business Associate will indicate in the Designated Record Set, any material it deems unavailable for inspection by the individual pursuant to 45 C.F.R. Section 164.524(a)(1). Covered Entity will make the final determination on the request.

(c) Business Associate will incorporate any amendment to PHI that Covered Entity directs or agrees to make no later than fifteen (15) days after Covered Entity requests the amendment be effected.

(iii) Accounting of Disclosures (45 C.F.R. 164.528)

(a) In order to allow Covered Entity to respond to an individual’s request for an accounting, Business Associate will provide Covered Entity with the information required by 45 C.F.R. Section 164.528 within five (5) business days of Covered Entity’s written request for the same.

Unless Covered Entity specifically requests otherwise, the information will be forwarded in electronic form.

(b) In the event any Individual requests an accounting of disclosure of PHI directly from Business Associate, Business Associate will forward such request to Covered Entity within two (2) business days.

(c) At a minimum, Business Associate will provide Covered Entity with the following information:

• the date of the disclosure;

• the name of the entity or person who received the PHI, and if known, the address of such entity or person;

• a brief description of the PHI disclosed; and

• a brief statement of the purpose of such disclosure.

(d) Business Associate will implement an appropriate recordkeeping process to enable it to comply with the requirements of this Subsection 1.3.4.

1.3.4 Keep Accurate and Detailed Records. Business Associate will keep such accurate and detailed records pertaining to:

(i) all disclosures of PHI to third parties, including those made to Business Associate’s directors, officers, employees, affiliates, agents, Subcontractors, and representatives, other than those disclosures that meet the exception criteria of 45 C.F.R. Section 164.528, for a period of at least six (6) years from the date of termination of this Agreement; and

(ii) the written agreements it enters into with Subcontractors. Business Associate will provide Covered Entity with a copy of such agreements, upon request, and will also keep a written list of all Subcontractors to whom Business Associate discloses PHI.

1.3.5 Cooperate with Covered Entity and the Secretary. Business Associate agrees that:

(i) Business Associate will submit such compliance reports, in such time and manner and containing such information, as the Secretary of HHS (“Secretary”) may determine to be necessary to verify compliance with applicable HIPAA provisions.

(ii) Business Associate will cooperate with the Secretary if the Secretary undertakes investigations or compliance review of the policies, procedures, or practices of Covered Entity or Business Associate. Business Associate will also cooperate with Covered Entity if Covered Entity undertakes an audit to determine Business Associate’s compliance with this Business Associate Agreement.

(iii) Business Associate must permit access to the Secretary and Covered Entity, as applicable, during normal business hours to its facilities, books, records, accounts and other sources of information, including PHI, in order for the Secretary or Covered Entity to ascertain Business Associate’s compliance with HIPAA provisions or this Business Associate Agreement, respectively.

(a) Notwithstanding the foregoing, if the Secretary determines that exigent circumstances exist, such as when documents may be hidden or destroyed, Business Associate must permit access by the Secretary at any time and without notice.

(b) If any information required of the Business Associate is under the exclusive possession of any other agency, institution, or person and the other agency, institution, or person fails to furnish the information, the Business Associate must so certify and set forth what efforts it has made to obtain the information.

(c) Business Associate will provide Covered Entity with copies of all documents provided to the Secretary or other regulatory and accreditation authorities.

(iv) In addition to Business Associate’s obligations under Section 1.3.5(iii)(c), Business Associate will provide copies of any documents reasonably requested by Covered Entity.

Documents will be made available to Covered Entity within fourteen (14) days of Covered Entity’s request at no charge.

1.3.6 Enter into Business Associate Agreements with Subcontractors.

(i) In accordance with 45 C.F.R. 164.314(a)(2)(B), Business Associate will enter into a signed written agreement with its Subcontractor(s), if any, that:

(a) Binds the Subcontractor to the same provisions, restrictions, and conditions as contained in this Business Associate Agreement;

(b) Contains reasonable assurances from Subcontractor that the PHI will be held confidential as provided in this Business Associate Agreement, and only disclosed as required by law or for the purposes for which it was disclosed to Subcontractor;

(c) Establishes the permitted and required uses and disclosures of PHI by the Subcontractor. The written agreement will not authorize the Subcontractor to use or further disclose PHI in a manner that would violate 45 C.F.R. Parts 160 and 164, Subparts A and E (the “Privacy Rule”) or Part 2, if done by Covered Entity;

(d) Obligates Subcontractor to forward a request from an individual to Business Associate on the same day that Subcontractor receives such requests;

(e) Obligates Subcontractor to immediately notify Business Associate of any breaches (including breaches of unsecured PHI as required by 45 C.F.R. 164.410) of the confidentiality of the PHI and Security Incidents (as defined in 45 C.F.R. 164.304) of which it becomes aware; and

(f) Requires the Subcontractor to comply with the applicable requirements of HIPAA (including but not limited to the Security and Privacy Rule) as well as Texas Privacy provisions.

(ii) Business Associate will provide Covered Entity with a copy of each such written agreement, upon request.

1.3.7 Survival. The provisions of this Section 1.3 will survive the termination of this Business Associate Agreement

1.4. Obligations of Covered Entity.

1.4.1 Resolve and Report All Appeals and Complaints. Any denial of access or amendment to PHI, which is determined by Covered Entity and conveyed to Business Associate by Covered Entity, will be the sole responsibility of Covered Entity. Covered Entity will resolve, and report all appeals and/or complaints arising from such denials.

2. RESTRICTIONS ON THE USE AND DISCLOSURE OF PHI

2.1. Except as otherwise specified herein, Business Associate may use or disclose any PHI necessary to perform its obligations under the Service Agreement.

2.2. Improper Uses and Disclosures.

2.2.1 Neither Business Associate nor its directors, officers, employees, Subcontractors, or agents will disclose PHI to any person other than a member of their respective workforces unless disclosure is required by law or authorized by the person whose PHI is to be disclosed.

2.2.2 Business Associate and its Subcontractors will not disclose PHI to any member of its respective workforce unless Business Associate or Subcontractor has advised such member of Business Associate’s obligations under this Business Associate Agreement, and of the consequences for such person and for Business Associate or such Subcontractor of violating them. Business Associate will take and will require that each of its Subcontractors and agents take appropriate disciplinary action against any member of its respective workforce who uses or discloses PHI in contravention of this Business Associate Agreement.

2.2.3 If PHI is used or disclosed by Business Associate in violation of this Business Associate Agreement, Business Associate will:

(i) notify Covered Entity within the timeframe described in Section 3.4;

(ii) upon Covered Entity’s direction, take steps to mitigate any harmful effect that is known to Business Associate and is the result of such improper use or disclosure, and

(iii) indemnify Covered Entity pursuant to Section 7 of this Business Associate

Agreement.

2.3. Minimum Necessary.

2.3.1 Business Associate will comply with Section 13405(b) of the HITECH Act, and any regulations or guidance issued by HHS concerning such provision, regarding the minimum necessary standard and the use and disclosure of Limited Data Sets.

2.3.2 Business Associate acknowledges and agrees that Section 13405(b) of the HITECH Act requires Business Associate to limit its uses and disclosures of PHI to either:

(i) the information making up a Limited Data Set (as defined in 45 C.F.R.

164.514); or

(ii) the minimum PHI necessary to accomplish the intended purpose of the use or disclosure.

3. REPORTING OF BREACHES, SECURITY INCIDENTS, AND IMPROPER DISCLOSURES

3.1. Definition of Breach. The term “Breach,” as used in this Agreement, refers to two (2) distinct types of breaches: a HIPAA Breach and a Breach of System Security.

3.1.1 A “HIPAA Breach” is the unauthorized acquisition, access, use, or disclosure of PHI in a manner not permitted by HIPAA and which compromises the security or privacy of such information.

3.1.2 A “Breach of System Security” means an unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of sensitive personal information (as defined in Section 521.002 of the Texas Business and Commerce Code) maintained by a person, including data that is encrypted if the person accessing the data has the key required to decrypt the data.

3.2. Breach Reporting.

3.2.1 In the event of a Breach of any Unsecured PHI (as defined in 45 C.F.R. 402) or sensitive personal information that Business Associate accesses, maintains, retains, modifies, records, stores, destroys, or otherwise holds or uses on behalf of Covered Entity, Business Associate will provide notice of the Breach to Covered Entity immediately, but in no event more than three (3) days after discovering the Breach.

(i) For purposes of this Business Associate Agreement, a Breach of Unsecured PHI or sensitive personal information will be treated as discovered by Business Associate as of the first day on which such Breach is known to Business Associate (including any person, other than the individual committing the Breach, who is an employee, officer, Subcontractor, or other agent of Business Associate, as determined in accordance with the federal common law of agency) or should have been known to Business Associate following the exercise of reasonable diligence.

3.2.2 Business Associate will be liable to, and indemnify Covered Entity for, unreasonable delays in reporting Breaches to Covered Entity.

3.2.3 Notice of a Breach will include, at a minimum:

(i) the identification of each individual whose PHI or sensitive personal information has been, or is reasonably believed to have been, accessed, acquired, or disclosed during the Breach;

(ii) the date of the Breach, if known, and the date the Breach was discovered;

(iii) a description of the types of PHI or sensitive personal information involved (e.g., names, Social Security numbers, dates of birth, home addresses, or medical record numbers);

(iv) a description of the Business Associate’s response to the Breach, if any (i.e., what the Business Associate has done to investigate the Breach and to protect against future Breaches); and

(v) any other reasonable information requested by Covered Entity.

3.3. Duties Following a Breach. In addition to Business Associate’s obligations under Section

3.2, Business Associate has a duty to:

3.3.1 inform Covered Entity of any new information learned by Business Associate regarding the Breach;

3.3.2 assist Covered Entity in:

(i) conducting a risk assessment of the Breach;

(ii) providing notice of the Breach as required by the Privacy and Security

Rule;

(iii) mitigating any harmful effect of such Breach;

3.3.3 pay all costs associated with mitigation and public or individual notice efforts (including the costs associated with a Subcontractor’s breach); and

3.3.4 appoint a liaison and provide contact information for same so that Covered Entity may ask Business Associate questions or learn additional information about the Breach.

3.4. Reporting of Security Incidents and Improper Disclosures. Business Associate will report to Covered Entity any Security Incident, unauthorized or improper use or disclosure of any PHI under the terms and conditions of this Business Associate Agreement or applicable federal and state laws as soon as practicable, but in no event later than two (2) days of the date on which Business Associate becomes aware of such use or disclosure.

4. EQUITABLE REMEDIES

4.1. Business Associate acknowledges and agrees that Covered Entity will suffer irreparable damage upon Business Associate’s breach of this Business Associate Agreement and that such damages will be difficult to quantify.

4.2. Business Associate acknowledges and agrees that, where Covered Entity has knowledge of any material breach by Business Associate, Covered Entity may file an action for injunction against Business Associate to enforce the terms of this Business Associate Agreement. Such proceeding may be brought before any Court having jurisdiction to obtain an injunction.

4.3. Business Associate acknowledges and agrees that Covered Entity may also pursue any other legal remedies available to Covered Entity to cure or stop such material breach.

5. TERM AND TERMINATION

5.1. General Term and Termination. This Business Associate Agreement will become effective on the Effective Date of the Service Agreement and will terminate when all PHI provided by either party to the other, or created or received by Business Associate on behalf of Covered Entity is, in accordance with Section 6, destroyed or returned to Covered Entity or, if it is not feasible to return or destroy PHI, protections are extended to such information, in accordance with the terms of Section 6 of this Business Associate Agreement.

5.2. Termination for Material Breach.

5.2.1 Where Covered Entity has knowledge of a material breach by Contractor, Covered

Entity may terminate both the Service and Business Associate agreements it has executed with Contractor. Such termination may occur before the expiration of the Service Agreement and without provision of notice or an opportunity for Contractor to cure.

(i) Business Associate commits a material breach of this Agreement if Business Associate:

(a) knows of a pattern of activity or practice of a Subcontractor that constitutes a material breach or violation of the Subcontractor’s obligation under the contract or other arrangement, unless the Business Associate takes reasonable steps to cure the breaches or end the violation, as applicable;

(b) impermissibly uses or discloses PHI;

(c) fails to provide Covered Entity with timely and accurate Breach notification;

(d) fails to provide timely access, either to Covered Entity, a requesting individual, or the requesting individual’s designee, to a copy of PHI;

(e) fails to provide a timely and accurate accounting;

(f) fails to timely disclose PHI where required by the Secretary;

(g) fails to fully comply with Texas law, the Security Rule, or the

Privacy Rule; or

(h) otherwise fails to fully comply with this Business Associate

Agreement.

5.2.2 Alternatively, Covered Entity will have the right to cure any breach of Business

Associate’s obligations under this Business Associate Agreement.

(i) When Covered Entity chooses to exercise this right, Covered Entity will give Business Associate notice of its election to cure any such breach, and Business Associate will cooperate fully.

(ii) Business Associate will compensate Covered Entity for the efforts Covered Entity undertakes to cure Business Associate’s breach. Payment for such efforts will be made to Covered Entity within thirty (30) days.

6. RETURN/DESTRUCTION OF PROTECTED HEALTH INFORMATION UPON TERMINATION Business Associate acknowledges that, as between Business Associate and Covered Entity, all PHI will be and remain the sole property of Covered Entity, including any and all forms thereof developed by Business Associate or its Subcontractors in the course of fulfillment of its obligations pursuant to this Business Associate Agreement and the Service Agreement. Upon termination of the Business Associate Agreement or Service Agreement for any reason, Business Associate will:

6.1. If feasible, return or destroy all PHI received from, or created or received by Business Associate on behalf of Covered Entity that Business Associate or any of its directors, officers, employees, affiliates, Subcontractors, agents, and representatives still maintain in any form; or

6.1.1 Business Associate agrees that all paper, film, or other hard copy media will be shredded or destroyed such that it may not be reconstructed, and EPHI will be purged or destroyed as set forth in the NIST Guidelines for media sanitization at http://www.csrc.nist.gov/.

6.2. If Covered Entity and Business Associate mutually determine that such return or destruction is not feasible, Business Associate’s will:

6.2.1 continue to use appropriate safeguards and comply with the Security Rule (45 C.F.R Part 164, Subpart C), with respect to EPHI;

6.2.2 extend the conditions of Section 2 of this Business Associate Agreement to all PHI retained by Business Associate;

6.2.3 further limit the uses and disclosures of PHI to those purposes that that make the return or destruction of the PHI infeasible (i.e., for the purposes for which such PHI was maintained);

and

6.2.4 return or destroy the PHI retained as soon as it is no longer needed by Business Associate for the purposes that made the return or destruction of the PHI infeasible.

7. INDEMNIFICATION Business Associate will indemnify, defend and hold harmless Covered Entity and its directors, officers, employees, affiliates, agents, and representatives from and against any and all actions, claims, costs (including court costs and attorneys’ fees), demands, suits, penalties, proceedings, losses and liabilities of any kind, arising from or relating to the acts or omissions of Business Associate or any of its directors, officers, employees, affiliates, agents, Subcontractors, and representatives in connection with Business Associate’s performance under this Business Associate Agreement, without regard to any limitation or exclusion of damages provision otherwise set forth in the Business Associate or Service Agreement. The indemnification provisions of this Section 7 will survive the termination of this Business Associate Agreement and will apply when actions, claims, demands, or proceedings are brought by a third party or when Business Associate commits a material breach of this Agreement, as described in Section 5.2.1.

8. AMENDMENT If any of the rules or regulations promulgated under HIPAA or state law are amended or interpreted in a manner that renders this Business Associate Agreement inconsistent therewith, Covered Entity may, on thirty (30) days written notice to Business Associate, amend this Business Associate Agreement to comply with such amendments or interpretations. Business Associate agrees that it will amend applicable Subcontractor agreements as necessary to comply with changes in laws or regulations.

9. CONFLICTING TERMS AND REQUIREMENTS In the event any terms of this Business Associate Agreement conflict with any terms of the Service Agreement, the terms of this Business Associate Agreement will govern and control. In the event of any conflict between this Business Associate Agreement and federal or Texas law, the more stringent requirements will govern.

(iv) In addition to Business Associate’s obligations under Section 1.3.5(iii)(c), Business Associate will provide copies of any documents reasonably requested by Covered Entity. Documents will be made available to Covered Entity within fourteen (14) d...

(ii) Business Associate will provide Covered Entity with a copy of each such written agreement, upon request.

1.3.7 Survival. The provisions of this Section 1.3 will survive the termination of this Business Associate Agreement

3.4. Reporting of Security Incidents and Improper Disclosures. Business Associate will report to Covered Entity any Security Incident, unauthorized or improper use or disclosure of any PHI under the terms and conditions of this Business Associate Agre...