Attachment L-1.3 Business Associate Agreement.docx

Attachment L-1.3 Business Associate Agreement

Business Associate Agreement for the Privacy and Security of Protected Health Information (PHI)

Introduction

In accordance with DOD 6025.18R, Department of Defense Health Information Privacy Regulation, the Potential Offeror meets the definition of Business Associate. Therefore, a Business Associate Agreement is required to comply with both the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security regulations. The Business Associate agrees to abide by all applicable HIPAA Privacy and Security requirements regarding health information as defined in this Agreement, and DOD 6025.18R, as amended.

(a) Definitions, as used in this section, generally refer to the Code of Federal Regulations (CFR) definition unless a more specific provision exists in DOD 6025.18R.

Individual has the same meaning as the term “individual'' in 45 CFR 164.501 and 164.103 and shall include a person who qualifies as a personal representative in accordance with 45 CFR 164.502(g).

Privacy Rule means the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E.

Protected Health Information has the same meaning as the term “protected health information” in 45 CFR 164.501, limited to the information created or received by the Business Associate from or on behalf of The Government.

Electronic Protected Health Information has the same meaning as the term “electronic protected health information” in 45 CFR 160.103.

Required by Law has the same meaning as the term “required by law'' in 45 CFR 164.501 and 164.103.

Secretary means the Secretary of the Department of Health and Human Services or his/her designee.

Security Rule means the Health Insurance Reform: Security Standards at 45 CFR part 160, 162 and part 164, subpart C.

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR 160.103, 164.501 and 164.304.

(b) The Business Associate agrees to not use or further disclose Protected Health Information other than as permitted or required by the Agreement or as required by law.

(c) The Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the Protected Health Information other than as provided for by this Agreement.

(d) The Business Associate agrees to use administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic protected health information that it creates, receives, maintains, or transmits in the execution of this Agreement.

(e) The Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of Protected Health Information in violation of the requirements of this Agreement.

(f) The Business Associate agrees to report to the Government any security incident involving protected health information of which it becomes aware.

(g) The Business Associate agrees to report to the Government any use or disclosure of the Protected Health Information not provided for by this Agreement of which the Business Associate becomes aware.

(h) The Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides Protected Health Information received from, or created or received by the Business Associate on behalf of the Government agrees to the same restrictions and conditions that apply through this Agreement to the Business Associate with respect to such information.

(i) The Business Associate agrees to ensure that any agent, including a subcontractor, to whom it provides electronic Protected Health Information agrees to implement reasonable and appropriate safeguards to protect it.

(j) The Business Associate agrees to provide access, at the request of the Government, and in the time and manner designated by the Government, to Protected Health Information in a Designated Record Set. This access shall be provided to the Government, or as directed by the Government, to an individual in order to meet the requirements under 45 CFR 164.524.

(k) At the request of the Government or an individual, the Business Associate agrees to make available any amendment(s) to Protected Health Information in a Designated Record Set, in the time and manner designated by the Government, pursuant to 45 CFR 164.526.

(l) The Business Associate agrees to make available to the Government, in a time and manner designated by the Government or the Secretary, internal practices, books, and records relating to the use and disclosure of Protected Health Information that were received from the Government, or created or received by the Business Associate on behalf of the Government, for purposes of the Secretary determining the Government’s compliance with the Privacy Rule.

(m) The Business Associate agrees to document such disclosures of Protected Health Information and information related to such disclosures as would be required for the Government to respond to a request by an Individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

(n) The Business Associate agrees to provide to the Government or an individual, in time and manner designated by the Government, information collected in accordance with this Agreement, to permit the Government to respond to a request by an individual for an accounting of disclosures of Protected Health Information in accordance with 45 CFR 164.528.

General Use and Disclosure Provisions

(a) The Business Associate agrees to use any Protected Health Information contained in the data provided by the Government only for the purposes of participating as a potential offeror, or assisting or consulting with a potential offeror, in solicitation HT9402-14-R-0001. The Protected Health Information will not be used for any other purposes including commercial purposes or government purposes.

(b) The Business Associate shall disclose Protected Health Information to other persons/entities solely for the purpose of obtaining assistance in data analysis and data forecasting to help the Business Associate develop its proposal in response to solicitation HT9402-14-R-0001. The Business Associate shall obtain reasonable assurances from the entity to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and that the person/entity shall notify the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached.

Obligations of the Government

Provisions for the Government to Inform the Business Associate of Privacy Practices and Restrictions

(a) Upon request by the Business Associate, the Government will provide the Business Associate with the notice of privacy practices that the Government produces in accordance with 45 CFR 164.520, as well as any changes to such notice.

(b) The Government will provide the Business Associate with any changes in, or revocation of, permission by Individual to use or disclose Protected Health Information, if such changes affect the Business Associate's permitted or required uses and disclosures.

(c) The Government will notify the Business Associate of any restriction to the use or disclosure of Protected Health Information that the Government has agreed to in accordance with 45 CFR 164.522.

Termination

(a) Termination. A breach by the Business Associate of this Agreement, may subject the Business Associate to termination of the Business Associate Agreement and will be reported to the cognizant contracting officer for consideration of other appropriate action.

(b) Effect of Termination.

(1) Upon the termination of this Agreement or the conclusion of the acquisition process for RFP HT9402-14-R-0001, whichever comes first, the Business Associate shall return or destroy all Protected Health Information received from the Government, or created or received by the Business Associate on behalf of the Government. This provision shall apply to Protected Health Information that is in the possession of subcontractors or agents of the Business Associate. The Business Associate shall retain no copies of the Protected Health Information.

(2) If the Business Associate determines that returning or destroying the Protected Health Information is infeasible, the Business Associate shall provide to the Government notification of the conditions that make return or destruction infeasible. Upon mutual agreement of the Government and the Business Associate that return or destruction of Protected Health Information is infeasible, the Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as the Business Associate maintains such Protected Health Information.

Miscellaneous

(a) Regulatory References. A reference in this Agreement to a section in DOD 6025.18R, Privacy Rule or Security Rule, means the section as in effect or as amended, and for which compliance is required.

(b) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the Government to comply with DOD 6025.18R, Privacy Rule or Security Rule.

Name of Business:

Name of Representative:

Title:

Signature:

Address:

Email Address: Phone Number

HT940220R0002 Page 1 of 4 Attachment L-1.3