SPECIAL_INSTRUCTIONS_HIPPA.pdf

SPECIAL INSTRUCTIONS

RESTRICTION ON THE USE OF GOVERNMENT‐AFFILIATED PERSONNEL

EMPLOYMENT NOTE: The Contractor can not employ any person who is an employee of the United

States Government if the employment of that person would create a conflict of interest. The contractor can not employ any person who is an employee of the Department of Defense, either military or civilian, unless such person seeks and receives approval in accordance with Title 5, USC, Section 5536, DoD

5500.7‐R (1993), as amended, and service directives.

HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT (HIPAA) OF

1996 Business Associate Agreement Introduction

In accordance with 45 CFR 164.502(e)(2) and 164.504(e) and paragraph C.3.4.1.3 of DoD 6025.18‐R, “DoD Health Information Privacy Regulation,” January 24, 2003, this document serves as a business associate agreement (BAA) between the signatory parties for purposes of the Health Insurance

Portability and Accountability Act (HIPAA) and the “HITECH Act” amendments thereof, as implemented by the HIPAA Rules and DoD HIPAA Issuances (both defined below). The parties are a DoD Military

Health System (MHS) component, acting as a HIPAA covered entity, and a DoD contractor, acting as a

HIPAA business associate. The HIPAA Rules require BAAs between covered entities and business associates. Implementing this BAA requirement, the applicable DoD HIPAA Issuance (DoD 6025.18‐R, paragraph C3.4.1.3) provides that requirements applicable to business associates must be incorporated

(or incorporated by reference) into the contract or agreement between the parties.

(a) Catchall Definition. Except as provided otherwise in this BAA, the following terms used in this BAA can have the same meaning as those terms in the DoD HIPAA Rules: Data Aggregation, Designated

Record Set, Disclosure, Health Care Operations, Individual, Minimum Necessary, Notice of Privacy

Practices (NoPP), Protected Health Information (PHI), Required By Law, Secretary, Security Incident, Subcontractor, Unsecured Protected Health Information, and Use.

Breach means actual or possible loss of control, unauthorized disclosure of or unauthorized access to PHI or other PII (which may include, but is not limited to PHI), where persons other than authorized users gain access or potential access to such information for any purpose other than authorized purposes, where one or more individuals will be adversely affected. The foregoing definition is based on the definition of breach in DoD Privacy Act Issuances as defined herein. Business Associate shall generally have the same meaning as the term “business associate” in the DoD HIPAA Issuances, and in reference to this BAA, shall mean the contract holder. Agreement means this BAA together with the documents and/or other arrangements under which the Business

Associate signatory performs services involving access to PHI on behalf of the MHS component signatory to this BAA. Covered Entity shall generally have the same meaning as the term “covered entity” in the

DoD HIPAA Issuances, and in reference to this BAA, shall mean the performance locations. DHA Privacy

Office means the DHA Privacy and Civil Liberties Office. The DHA Privacy Office Director is the HIPAA

Privacy and Security Officer for DHA, including the National Capital Region Medical Directorate

(NCRMD). DoD HIPAA Issuances means the DoD issuances implementing the HIPAA Rules in the DoD

Military Health System (MHS). These issuances are DoD 6025.18‐R (2003), DoDI 6025.18

(2009), and DoD 8580.02‐R (2007).

DoD Privacy Act Issuances means the DoD issuances implementing the Privacy Act, which are

DoDD 5400.11 (2007) and DoD 5400.11‐R (2007).

HHS Breach means a breach that satisfies the HIPAA Breach Rule definition of breach in 45

CFR 164.402.

HIPAA Rules means, collectively, the HIPAA Privacy, Security, Breach and Enforcement Rules, issued by the U.S. Department of Health and Human Services (HHS) and codified at 45 CFR Part

160 and Part 164, Subpart E (Privacy), Subpart C (Security), Subpart D (Breach) and Part 160, Subparts C‐D (Enforcement), as amended by the 2013 modifications to those Rules, implementing the “HITECH Act” provisions of Pub. L. 111‐5. See 78 FR 5566‐5702 (Jan. 25, 2013) (with corrections at 78 FR 32464 (June 7, 2013)). Additional HIPAA rules regarding electronic transactions and code sets (45 CFR Part 162) are not addressed in this BAA and are not included in the term HIPAA Rules.

Service‐Level Privacy Office means one or more offices within the military services (Army, Navy, or Air Force) with oversight authority over Privacy Act and/or HIPAA privacy compliance.