HIPAA_BAA_1.2025.docx

HIPAA BUSINESS ASSOCIATE AGREEMENT

This Agreement (hereinafter referred to as AGREEMENT) is entered into by and between Pinellas County, a political subdivision of the State of Florida (hereinafter referred to as COVERED ENTITY) and (BUSINESS ASSOCIATE NAME), (hereinafter referred to as BUSINESS ASSOCIATE) (and collectively hereinafter referred to as the PARTIES) on the date last executed below.

WHEREAS, BUSINESS ASSOCIATE performs functions, activities, or services for, or on behalf of COVERED ENTITY, and BUSINESS ASSOCIATE receives, has access to or creates Health Information in order to perform such functions, activities or services; and WHEREAS, the PARTIES are subject to the requirements of the Health Insurance Portability and Accountability Act of 1996 (hereinafter referred to as HIPAA) and the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 (hereinafter referred to as the “HITECH Act”), and the implementing regulations and guidance issued pursuant to these Acts by the United States Secretary of the Department of Health and Human Services (the “Secretary”), including but not Limited to, the Administrative Requirements and Security Standards codified in 45 Code of Federal Regulations Parts 160, 162 and 164, and other applicable state and federal laws, all as amended from time to time; and WHEREAS, HIPAA requires COVERED ENTITY to enter into an agreement with BUSINESS ASSOCIATE to provide for the protection of the privacy and security of Health Information, and HIPAA prohibits the disclosure to or use of Health Information by BUSINESS ASSOCIATE if such a contract is not in place; and WHEREAS, the PARTIES enter into this agreement in order to comply with the terms of HIPAA.

NOW, THEREFORE, in consideration of the foregoing, and for other good and valuable consideration, the receipt and adequacy of which is hereby acknowledged, the PARTIES agree as follows:

ARTICLE I

DEFINITIONS

1.6 “Privacy Regulations” shall mean the Standards for Privacy of Covered Individually Identifiable Health Information, 45 Code of Federal Regulations Parts 160 and 164, promulgated under HIPAA.

ARTICLE II

OBLIGATIONS OF BUSINESS ASSOCIATE

b. Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information, to prevent use or disclosure of protected health information other than as provided for by the Agreement.

c. Report to COVERED ENTITY any unauthorized acquisition, access, use or disclosure of protected health information not provided for by the Agreement of which it becomes aware, including breaches of unsecured protected health information as required at 45 CFR 164.410, and any security incident of which it becomes aware.

d. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, ensure that any subcontractors that create, receive, maintain, or transmit protected health information on behalf of the BUSINESS ASSOCIATE agree to the same restrictions, conditions, and requirements that apply to the BUSINESS ASSOCIATE with respect to such information.

e. Make available protected health information in a designated record set to the individual or COVERED ENTITY in response to such individual’s request in the time and manner required under 45 CFR 164.524.

f. Make any amendment(s) to protected health information in a designated record set as directed or agreed to by the individual pursuant to 45 CFR 164.526, or take other measures as necessary to satisfy COVERED ENTITY’S obligations under 45 CFR 164.526.

g. Maintain and make available the information required to provide an accounting of disclosures to the COVERED ENTITY as necessary to satisfy COVERED ENTITY’S obligations under 45 CFR 164.528.

h. To the extent the BUSINESS ASSOCIATE is to carry out one or more of COVERED ENTITY’S obligation(s) under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the COVERED ENTITY in the performance of such obligation(s).

i. Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with the HIPAA Rules.

j. Comply with all HIPAA and HITECH Act requirements, as they may be amended from time to time.

2.3 Permitted Uses and Disclosures of Health Information. BUSINESS ASSOCIATE is authorized to:

a. Use and Disclose Health Information as necessary to perform services for, or on behalf of COVERED ENTITY.

b. Use Health Information to create aggregated or de-identified information consistent with the requirements of the Privacy Regulations.

c. Use or Disclose Health Information (including aggregated or de-identified information) as otherwise directed by COVERED ENTITY provided that COVERED ENTITY shall not request BUSINESS ASSOCIATE to use or disclose Health Information in a manner that would not be permissible if done by COVERED ENTITY.

d. To the extent required by the HITECH Act, BUSINESS ASSOCIATE shall limit its use, disclosure or request of protected health information to the Limited Data Set or, if needed, to the minimum necessary to accomplish the intended use, disclosure or request, respectively. Effective on the date the Secretary issues guidance on what constitutes "minimum necessary" for purposes of HIPAA, BUSINESS ASSOCIATE shall limit its use, disclosure or request of protected health information to only the minimum necessary as set forth in such guidance.

e. BUSINESS ASSOCIATE shall not use Health Information for any other purpose that would violate Subpart E of 45 CFR Part 164, except that if necessary, BUSINESS ASSOCIATE may use Health Information for the proper management and administration of BUSINESS ASSOCIATE or to carry out its legal responsibilities, provided that any use or disclosure described herein will not violate the Privacy Regulations or Florida law if done by COVERED ENTITY. Except as otherwise limited in this Agreement, BUSINESS ASSOCIATE may disclose Health Information for the proper management and administration of the BUSINESS ASSOCIATE, provided that with respect to any such disclosure either: (a) the disclosure is required by law (within the meaning of the Privacy Regulations) or (b) the disclosure would not otherwise violate Florida law and BUSINESS ASSOCIATE obtains reasonable written assurances from the person to whom the information is to be disclosed that such person will hold the information in confidence and will not use or further disclose such information except as required by law or for the purpose(s) for which it was disclosed by BUSINESS ASSOCIATE to such person, and that such person will notify BUSINESS ASSOCIATE of any instances of which it is aware in which the confidentiality of the information has been breached.

c. Be in compliance with all requirements of the HITECH Act related to security and applicable as if BUSINESS ASSOCIATE were a covered entity, as such term is defined in HIPAA.

d. BUSINESS ASSOCIATE shall use its best efforts to implement and maintain technologies and methodologies that render PHI unusable, unreadable or indecipherable to unauthorized individuals as specified in the HITECH Act.

1) Investigate such unauthorized acquisition, access, use or disclosure;

2) Determine whether such unauthorized acquisition, access, use or disclosure constitutes a reportable breach under the HITECH Act; and

3) Document and retain its findings under clauses 1) and 2) of this section.

a. Provide to COVERED ENTITY an accounting of each disclosure of Health Information made by BUSINESS ASSOCIATE or its employees, agents, representatives or subcontractors as required by the Privacy Regulations. For each Disclosure that requires an accounting under this Section 2.10, BUSINESS ASSOCIATE shall track the information required by the Privacy Regulations, and shall securely maintain the information for six (6) years from the date of the Disclosure.

b. If BUSINESS ASSOCIATE is deemed to use or maintain an Electronic Health Record on behalf of COVERED ENTITY, then BUSINESS ASSOCIATE shall maintain an accounting of any disclosures made through an Electronic Health Record for treatment, payment and health care operations, as applicable. Such accounting shall comply with the requirements of the HITECH Act.

c. Upon request by COVERED ENTITY, BUSINESS ASSOCIATE shall provide such accounting to COVERED ENTITY in the time and manner specified by the HITECH Act.

d. Where COVERED ENTITY responds to an individual's request for an accounting of disclosures made through an Electronic Health Record by providing the requesting individual with a list of all business associates acting on behalf of COVERED ENTITY, BUSINESS ASSOCIATE shall provide such accounting directly to the requesting individual in the time and manner specified by the HITECH Act.

a. If BUSINESS ASSOCIATE is deemed to use or maintain an Electronic Health Record on behalf of COVERED ENTITY with respect to PHI, BUSINESS ASSOCIATE shall provide an individual with a copy of the information contained in such Electronic Health Record in an electronic format and, if the individual so chooses, transmit such copy directly to an entity or person designated by the individual upon request, to the extent an individual has the right to request a copy of the PHI maintained in such Electronic Health Record pursuant to 45 CFR 164.524 and makes such a request to BUSINESS ASSOCIATE.

b. BUSINESS ASSOCIATE may charge a fee to the individual for providing a copy of such information, but such fee may not exceed BUSINESS ASSOCIATE's labor costs in responding to the request for the copy.

c. The provisions of 45 CFR 164.524, including the exceptions to the requirement to provide a copy of PHI shall otherwise apply and BUSINESS ASSOCIATE shall comply therewith as if BUSINESS ASSOCIATE were the COVERED ENTITY.

d. At COVERED ENTITY's request, BUSINESS ASSOCIATE shall provide COVERED ENTITY with a copy of an individual's PHI maintained in an Electronic Health Record in an electronic format in a time and manner designated by COVERED ENTITY in order for COVERED ENTITY to comply with 45 CFR 164.524, as amended by the HITECH Act.

1) Complies with the requirements the definition of marketing contained in 45 CFR 164.501; and

2) Complies with the requirements of Subparagraphs a, b or c of Section 13406(a)(2) of the HITECH Act.

b. COVERED ENTITY shall cooperate with BUSINESS ASSOCIATE to determine if the foregoing requirements are met with respect to any such marketing communication.

ARTICLE III

TERM AND TERMINATION

a. Upon becoming aware of a pattern of activity or practice of either PARTY that constitutes a material breach or violation of obligations under the AGREEMENT, the non-breaching PARTY shall immediately notify the PARTY in breach.

b. Notification shall be provided in writing and shall specify the nature of the breach.

c. With respect to such breach or violation, upon receiving notice of the violation the non-breaching PARTY shall:

1) Allow the breaching PARTY thirty (30) days to take reasonable steps to cure such breach or end such violation; and

2) Terminate this AGREEMENT, if cure is either not possible or unsuccessful; and

3) Report the breach or violation to the Secratary if such termination is not feasible.

d. Upon termination of this AGREEMENT for any reason, BUSINESS ASSOCIATE shall return or destroy all PHI consistent with Section 3.4 as follows:

1) BUSINESS ASSOCIATE shall destroy PHI in a manner that renders the PHI unusable, unreadable or indecipherable to unauthorized individuals as specified in the HITECH Act and shall certify in writing to COVERED ENTITY that such PHI has been destroyed in compliance with such standards; or

2) Return of PHI shall be made in a mutually agreed upon format and timeframe and at no additional cost to BUSINESS ASSOCIATE.

ARTICLE IV

(Name)____________________

(Address)__________________

If to COVERED ENTITY:

(Name)____________________

(Address)__________________

IN WITNESS WHEREOF, each of the undersign his cause this AGREEMENT to be duly executed in its name and on its behalf effective as of the date last executed below.

COVERED ENTITY: BUSINESS ASSOCIATE:

Pinellas County Human Resources Business Associate Name

By: _______________________________ By: ______________________________

Print Name: _______________________ Print Name: ________________________

Print Title: ________________________ Print Title: _________________________

Date: _____________________________ Date: ______________________________

APPROVED AS TO FORM

OFFICE OF COUNTY ATTORNEY

By: ___________________________ Assistant County Attorney