Exhibit F.docx

SCDMH BUSINESS ASSOCIATE/QUALIFIED SERVICE ORGANIZATION AGREEMENT

The South Carolina Department of Mental Health, including its inpatient/outpatient facilities and programs (“SCDMH”), is a “Covered Entity” subject to: the Health Insurance Portability and Accountability Act (HIPAA) 45 CFR Part 4-4-160 et seq, including Privacy Rule, Security Rule and Breach Notification Rule requirements, 45 CFR 164 et seq (HITECH); §44-22-100, Code of Laws of South Carolina (SCDMH patients or persons subject to commitment confidentiality); and also for specific SCDMH Alcohol and Drug Treatment Programs: Confidentiality of Alcohol and Drug Abuse Patient records, 42 CFR Part 2, in protecting Protected Health Information (PHI), and/or applicable law protecting other Personally Identifiable Information (PII), collectively “Applicable Law.”

at the address of , is a SCDMH Business Associate/Qualified Service Organization (BA/QSO), who by SCDMH contract/other written agreement, receives information from, creates or receives PHI and/or PII, on behalf of SCDMH.

BA/QSO in receiving from, or creating/receiving PHI and/or PII on behalf of SCDMH, acknowledges and agrees:

1. In receiving, transmitting, disclosing, transporting, storing, processing, using, or otherwise dealing with PHI and/or PII, be bound by Applicable Law, and not use or disclose PHI and/or PII except as permitted or required by this Agreement, Applicable Law, SCDMH Privacy and/or Security Practices, and any contract or other written agreement with SCDMH.

2. Consistent with this Agreement, BA/QSO may disclose minimum necessary PHI and/or PII for its management and administration, or to carry out its legal responsibilities, provided the disclosures are required by law, or BA/QSO obtains reasonable assurances from the person to whom the PHI and/or PII is disclosed, that PHI and/or PII will remain confidential and used or further disclosed only as required by law, or for the purposes for which it was disclosed, and the person notifies BA/QSO of any instances it is aware where PHI and/or PII confidentiality has been Breached.

3. Use appropriate safeguards to prevent unauthorized use or disclosure of PHI and/or PII (“Breach”).

4. Following discovery of a Breach, consistent with Applicable law, promptly report such Breach to the applicable local SCDMH Privacy Officer.

5. Ensure that its subcontractors and agents, to whom PHI and/or PII is provided, or created or received on behalf of SCDMH, protect PHI and/or PII including Breach reporting as described above.

6. Provide access to PHI as requested by SCDMH, including to an individual as directed by SCDMH, to meet HIPAA requirements of providing a SCDMH patient the right to access and copy their PHI.

7. Amend PHI as directed or agreed to by SCDMH pursuant to HIPAA requirements.

8. Make available its practices, policies, procedures and records, related to PHI and/or PII use and disclosure, to SCDMH, (and for PHI, Department of Health and Human Services, or to an individual/entity as directed by SCDMH related to HIPAA compliance).

9. Document its disclosures of PHI, as required by HIPAA, for SCDMH to promptly respond to a request for an accounting of PHI disclosures, and provide such accounting to SCDMH or an individual as directed by SCDMH.

10. [Applies only to SCDMH Alcohol & Drug Treatment Program PHI AND/OR PII] As a SCDMH Qualified Service Organization under 42 CFR Part 2, resist efforts in judicial proceedings to obtain PHI as required by 42 CFR Part 2.

11. Upon termination of this Agreement for any reason, return or destroy PHI and/or PII received/created by this Agreement, including PHI and/or PII possessed by its subcontractors or agents. If returning or destroying the PHI and/or PII is infeasible, BA/QSO will notify SCDMH of conditions that make return/destruction infeasible and extend Agreement protections to such PHI and/or PII, and limit further uses/disclosures to purposes that make return/destruction infeasible, as long as BA/QSO maintains the PHI and/or PII.

12. To the extent BA/QSO carries out obligations under the Privacy Standards on Covered Entities behalf, BA/QSO will comply with applicable Privacy Standard(s) in performing such obligation.

13. BA/QSO will comply with security provisions of HITECH in the same manner as such regulations apply to SCDMH.

14. Upon request, BA/QSO will provide SCDMH access to, and information concerning, BA/QSO’s security and privacy policies, processes, practices, impact and risk assessments, and actions taken to mitigate identified risks affecting PHI and/or PII provided to or created by BA/QSO pursuant to this Agreement.

15. BA/QSO will report to SCDMH security incidents of which it becomes aware that compromise PHI and/or PII confidentiality, integrity, or availability. Unsuccessful Security Incidents, involving unsuccessful attempts at unauthorized access to BA/QSO’s system, that are not a threat to PHI and/or PII and do not result in unauthorized access, use, disclosure, modification, or destruction of PHI and/or PII or interference with an information system, are not required to be reported. Unsuccessful Security Incidents include: (a) “pings”: request/response to determine if an Internet Protocol (IP) address, or host, exists or is accessible; (b) port scans; and (c) malware: viruses and worms detected and eradicated prior to effecting BA/QSO‘s system; (d) attempts to log on to system or enter database with invalid password or username; and (e) denial of service attacks that do not result in a server taken offline. If BA/QSO’s system is capable of logging such Incidents, upon SCDMH written request, BA/QSO will report such Incidents in the aggregate.

16. BA/QSO will require any BA/QSO subcontractor to a SCDMH contract or other SCDMH written agreement with BA/QSO, to agree in writing to comply with this Agreement.

17. SCDMH may terminate this Agreement if it determines that BA/QSO or subcontractor has violated any material term.

BA/QSO Signature Printed Name Title Date

BA/QSO-April 2016