KCAB_Business_Associate_Agreement.pdf

Form 005

Business Associate Agreement Between

KENTON COUNTY AIRPORT BOARD

And

This Business Associate Agreement (“Agreement”) supplements and is made part of the Underlying Agreements (as defined below).

This Agreement is entered into between Kenton County Airport Board, a municipal corporation formed and operating under the provisions of Chapter 183 of the Kentucky Revised Statutes, and _____________________________ (“Business Associate”), effective as of J u l y 1 , 2 0 2 5 ( the “ Effective Date”).

The Kenton County Airport Board designated itself as a hybrid entity, pursuant to 45

C.F.R. §164.103, and the covered components of the Kenton County Airport Board, as more specifically described in its HIPAA Policies and Procedures, are the “Covered Entity” as defined below;

Covered Entity and Business Associate have entered into, or plan to enter into, a n agreement(s) pursuant to which Business Associate may provide services for Covered Entity that require Business Associate to access, create, and use Protected Health Information (“PHI”) that is confidential under state and federal law (the “Underlying Agreements”);

Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed by Covered Entity to Business Associate, or collected or created by Business Associate pursuant to the Underlying Agreements, in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), and the regulations promulgated thereunder, including, without limitation, the regulations codified at 45 CFR Parts 160 and 164 (“HIPAA Regulations”); the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009 (“ARRA”), and its implementing regulations and guidance issued by the Secretary of the Department of Health and Human Services (the “Secretary”) (the “HITECH Act”); and other applicable state and federal laws, all as amended from time to time, including as amended by the Final Rule issued by the Secretary on January 17, 2013 titled “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules”; and.

The HIPAA Regulations require Covered Entity to enter into an agreement with

Business Associate meeting certain requirements with respect to the Use and Disclosure of PHI, which are met by this Agreement.

Accordingly, the parties agree as follows:

1. Definitions.

Business Associate means a person or entity who, on behalf of a covered entity, performs or assists in performance of a function or activity involving the use or disclosure of individually identifiable health information, or any other function or activity regulated by the HIPAA Administrative Simplification Rules, including the Privacy Rule. Business Associates are also persons or entities performing legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for a covered entity where performing those services involves disclosure of individually identifiable health information by the covered entity or another business associate of the covered entity to that person or entity. A member of a covered entity’s workforce is not one of its business associates. A covered entity may be a business associate of another covered entity. 45 C.F.R. § 160.103.

Covered Entity means a health plan, a health care clearinghouse, or a health care provider who transmits health information in electronic form in connection with a transaction for which the U.S.

Department of Health and Human Services has adopted a standard. 45 C.F.R. § 160.103.

Covered Functions means those functions of a covered entity the performance of which makes the entity a health plan, health care provider, or health care clearinghouse. 45 C.F.R. § 160.103.

Disclose or Disclosure means the release, transfer, access to, or divulging of information in any other manner outside the entity holding the information. 45 C.F.R. § 160.103.

HIPAA Policies and Procedures means any and all HIPAA policies and procedures adopted or will be adopted by the Kenton County Airport Board.

Hybrid Entity means a single legal entity that is a covered entity, performs business activities that include both covered and non-‐covered functions, and designates its health care components as provided in the Privacy Rule. 45 C.F.R. § 164.103.

Protected Health Information (or PHI) means individually identifiable information transmitted or maintained in electronic media (ePHI) or transmitted or maintained in any form or medium. PHI excludes education records covered by the Family Educational Rights and Privacy Act, as amended, 20 U.S.C. § 1232g, records described at 20 U.S.C. § 1232g(a)(4)(B)(iv), and employment records held by a covered entity in its role as employer. 45 C.F.R. § § 164.501, 160.103.

Use means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within the entity or health care component (for hybrid entities) that maintains such information. 45 C.F.R. § 160.103.

Any terms not specifically defined here have the meanings ascribed to them in the HIPAA Regulations or the HITECH Act, as applicable unless otherwise defined in this Agreement.

2. Obligations of Business Associate.

a. Permitted Uses and Disclosures. Business Associate may only Use or

Disclose PHI for the purposes of (i) performing Business Associate’s obligations under the Underlying Agreements and as permitted by this Agreement; or (ii) as permitted or Required By Law; or (iii) as otherwise permitted by this Agreement. Business Associate m a y not Use or further Disclose PHI other than as permitted or required by this Agreement or as Required By Law. Further, Business Associate shall not Use or Disclose PHI in any manner that would constitute a violation of the HIPAA Regulations or the HITECH Act if so used by Covered Entity, except that Business Associate may Use PHI (i) for the proper management and administration of Business Associate; and (ii) to carry out the legal responsibilities of Business Associate. Business Associate may Disclose PHI for the proper management and administration of Business Associate, to carry out its legal responsibilities or for payment purposes as specified in 45 CFR § 164.506(c)(1) and (3), including but not limited to Disclosure to a business associate on behalf of a covered entity or health care provider for payment purposes of such covered entity or health care provider, with the expectation that such parties will provide reciprocal assistance to Covered Entity, provided that with respect to any such Disclosure either: (i) the Disclosure is Required By Law; or (ii) for permitted Disclosures when Required By Law, Business Associate must obtain a written agreement from the person to whom the PHI is to be Disclosed that such person must hold the PHI in confidence and not use or further disclose such PHI except as Required By Law and for the purpose(s) for which it was Disclosed by Business Associate to such person, and that such person will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached.

b. Creation and Use of De-Identified Data. Business Associate may de-identify any and all PHI, provided that any process or mechanism used to de-identify the data meets the requirements of 45 C.F.R 164.514(a)-(b). Business Associate may use or disclose (and permit others to use or disclose) such de-identified data on a perpetual unrestricted basis, but Business Associate may not attempt to run or develop any keys, codes or algorithms that could be used to re-identify the data.

c. Appropriate Safeguards. Business Associate must comply with Subpart

C of 45 C.F.R. Part 164 with respect to electronic protected health information and implement administrative, physical and technical safeguards that (i) reasonably and appropriately protect the confidentiality, integrity and availability of electronic PHI that it creates, receives, maintains or transmits on behalf of Covered Entity; and (ii) prevent the Use or Disclosure of PHI other than as contemplated by the Underlying Agreements and this Agreement.

d. Compliance with Security Provisions. Business Associate m u s t : (i) implement and maintain administrative safeguards as required by 45 CFR § 164.308, physical safeguards as required by 45 CFR § 164.310 and technical safeguards as required by 45 C.F.R.§ 164.312; (ii) implement and document reasonable and appropriate policies and procedures as required by 45 CFR § 164.316; and (iii) be in compliance with all requirements of the HITECH Act related to security and applicable as if Business Associate were a “covered entity,” as defined in HIPAA.

e. Compliance with Privacy Provisions. Business Associate may only Use and Disclose PHI in compliance with each applicable requirement of 45 CFR § 164.504(e).

Business Associate must comply with all requirements of the HITECH Act related to privacy and applicable as if Business Associate were a “covered entity,” as defined in HIPAA. To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, Business Associate must comply with the requirements of Subpart E that apply to Covered Entity in the performance of these obligation(s).

f. Duty to Mitigate. Business Associate agrees to mitigate, to the extent practicable and mandated by law, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of the requirements of this Agreement.

3. Reporting and Indemnity.

a. Security Incidents and/or Unauthorized Use or Disclosure. Business

Associate must report to Covered Entity a successful Security Incident or any Use and/or Disclosure of PHI other than as provided for by this Agreement or permitted by applicable law within a reasonable time of becoming aware of the Security Incident and/or unauthorized Use or Disclosure (but not later than ten (10) days thereafter), in accordance with the notice provisions set forth in this Agreement. Business Associate must take (i) prompt action to cure any such deficiencies as reasonably requested by Covered Entity, and (ii) any action pertaining to such Security Incident and/or unauthorized Use or Disclosure required by applicable federal and state laws and regulations. If such successful Security Incident or unauthorized Use or Disclosure results in a breach as defined in the HITECH Act, then Business Associate must comply with the requirements of Section 3.b below. The Parties acknowledge and agree that this Section constitutes notice by Business Associate to Covered Entity of the ongoing existence and occurrence of attempted but Unsuccessful Security Incidents. “Unsuccessful Security Incidents” include, but a r e not limited to, pings and other broadcast attacks on Business Associate’s firewall, port scans, unsuccessful log-on attempts, denials of service and any combination of the above, so long as no incident results in unauthorized access, use, or disclosure of PHI.

b. Breach of Unsecured PHI. With respect to any unauthorized acquisition, access, Use, or Disclosure of Covered Entity’s PHI by Business Associate, its agents or subcontractors, Business Associate must (i) investigate the unauthorized acquisition, access, Use, or Disclosure; (ii) determine whether the unauthorized acquisition, access, Use, or Disclosure constitutes a reportable breach under the HITECH Act; and (iii) document and retain its findings under clauses (i) and (ii). If Business Associate discovers that a reportable breach has occurred, Business Associate m u s t notify Covered Entity of the reportable breach in writing within thirty (30) days of the date Business Associate discovers the breach. Business Associate is deemed to have discovered a breach as of the first day that the breach is either known to Business Associate or any of its employees, officers or agents, other than the person who committed the breach, or by exercising reasonable diligence should have been known to Business Associate or any of its employees, officers or agents, other than the person who committed the breach. To the extent the information is available to Business Associate, Business Associate’s written notice must include the information required by 45 CFR § 164.410(c).

Business Associate must promptly supplement the written report with additional information regarding the breach as it obtains additional information. Business Associate must cooperate with Covered Entity in meeting Covered Entity’s obligations under the HITECH Act with respect to the breach. Business Associate must also provide, at its cost and expense, all legally required notices that are required of the Covered Entity that may arise under this section 3(b). In the event of Business Associate’s Use or Disclosure of Unsecured PHI in violation of HIPAA, the HITECH Act, or ARRA, Business Associate bears the burden of demonstrating that notice as required under this Section 3.b was made, including evidence demonstrating the necessity of any delay, or that the Use or Disclosure did not constitute a breach of Unsecured PHI.

c. Liability for Breach. Business Associate acknowledges it is directly liable under the civil and criminal enforcement provisions set forth at 42 U.S.C. §1320d-5 and §1320d- 6, as amended, for failure to comply with any of the Use and Disclosure requirements of this Agreement and any guidance issued by the Secretary periodically with respect to the Use and Disclosure requirements.

d. Indemnification. Covered Entity and Business Associate agree and acknowledge that except as set forth in this Agreement, the indemnification obligations contained in the Underlying Agreements between the Parties governs each party’s performance under this Agreement. To the extent that the Covered Entity and Business Associate do not have any Underlying Agreements or Underlying Agreements which include indemnification obligations, Business Associate must indemnify, defend, and hold harmless the Covered Entity and Covered Entity's affiliates, including its directors, employees, and agents ("Indemnified Parties"), from and against any and all losses, expense, damage, or injury (including, without limitation, all costs and reasonable attorneys' fees) that the Indemnified Parties may sustain as a result of, or arising out of

(a) a breach of this Agreement by Business Associate or its agents or subcontractors, including but not limited to any unauthorized Use, Disclosure, or breach of PHI, (b) Business Associate's failure to notify any and all parties required to receive notification of any breach of Unsecured PHI, or (c) any negligence or wrongful acts or omissions by Business Associate or its agents or subcontractors, including without limitations, failure to perform Business Associate's obligations under this Agreement, the Privacy Rule, or the Security Rule. Notwithstanding the foregoing, nothing in this section limits any rights the Indemnified Parties may have to additional remedies under the Underlying Agreements or under applicable law for any acts or omissions of Business Associate or its agents or Subcontractors. This obligation to indemnify survives termination or expiration of this Agreement.

e. Access to Internal Policies. Business Associate agrees to make its internal practices, books, and records, including policies and procedures regarding PHI, relating to the Use and Disclosure of PHI and breach of any Unsecured PHI received from Covered Entity, or created or received by the Business Associate on behalf of Covered Entity, available to Covered Entity (or the Secretary) for the purpose of Covered Entity or the Secretary determining compliance with the Privacy Rule.

4. Business Associate’s Agents . To the extent that Business Associate uses one or more subcontractors or agents to provide services under the Underlying Agreements, and those subcontractors or agents receive or have access to PHI, Business Associate must sign an agreement with such subcontractors or agents containing substantially the same provisions as this Agreement. In accordance with 45 C.F.R. § 164.502(e)(1)(ii) and 164.308(b)(2), all subcontractors or agents as described herein are subject to the same restrictions, conditions, and requirements that apply to the Business Associate with respect to such information.

5. Rights of Individuals.

a. Access to PHI. Within ten (10) days of receipt of a request by Covered

Entity, Business Associate must make PHI maintained in a Designated Record Set available to Covered Entity or, as directed by Covered Entity, to an Individual to enable Covered Entity to fulfill its obligations under 45 CFR § 164.524. Subject to Section 5.b below, (i) in the event that any Individual requests access to PHI directly from Business Associate in connection with a routine billing inquiry, Business Associate must directly respond to such request in compliance with 45 CFR § 164.524; and (ii) in the event a request appears to be for a purpose other than a routine billing inquiry, Business Associate must forward a copy of the request to Covered Entity and fully cooperate with Covered Entity in responding to the request. In either case, a Business Associate may not deny access to requested PHI without the prior written consent of Covered Entity.

b. Access to Electronic Health Records. If Business Associate is deemed to use or maintain an Electronic Health Record on behalf of Covered Entity with respect to PHI, then, to the extent an Individual has the right to request a copy of the PHI maintained in the Electronic Health Record pursuant to 45 CFR § 164.524 and makes a request to Business Associate, Business Associate must provide the Individual with a copy of the information contained in the Electronic Health Record in an electronic format and, if the Individual so chooses, transmit a copy directly to an entity or person designated by the Individual. Business Associate may charge a fee to the Individual for providing a copy of the information, but any fee may not exceed Business Associate’s labor costs in responding to the request for the copy. The provisions of 45 CFR § 164.524, including the exceptions to the requirement to provide a copy of PHI, otherwise apply and Business Associate must comply as if Business Associate were the “covered entity,” as defined in HIPAA. At Covered Entity’s request, Business Associate must provide Covered Entity with a copy of an Individual’s PHI maintained in an Electronic Health Record in an electronic format and in a time and manner designated by Covered Entity in order for Covered Entity to comply with 45 CFR § 164.524, as amended by the HITECH Act.

c. Amendment of PHI. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of Covered Entity or an Individual, and in the time and manner designated by Covered Entity.

d. Accounting Rights. This Section 5.d is subject to Section 5.e below.

Business Associate must make available to Covered Entity, in response to a request from an Individual, information required for an accounting of disclosures of PHI with respect to the Individual, in accordance with 45 CFR § 164.528, incorporating exceptions to the accounting designated under the regulation. The accounting is limited to disclosures that were made in the six

(6) years prior to the request and do not include any disclosures that were made prior to the compliance date of the HIPAA Regulations. Business Associate must provide information as is necessary to provide an accounting within ten (10) days of Covered Entity’s request. The accounting must be provided without cost to the Individual or to Covered Entity if it is the first accounting requested by an Individual within any twelve (12) month period; however, a reasonable, cost-based fee may be charged for subsequent accountings if Business Associate informs Covered Entity and Covered Entity informs the Individual in advance of the fee, and the Individual is afforded an opportunity to withdraw or modify the request. Accounting obligations survive termination of this Agreement and continue as long as Business Associate maintains

PHI.

e. Accounting of Disclosures of Electronic Health Records. The provisions of this Section 5.e are effective on the date specified in the HITECH Act. If Business Associate is deemed to use or maintain an Electronic Health Record on behalf of Covered Entity, then, in addition to complying with the requirements set forth in Section 5.d above, Business Associate must maintain an accounting of any Disclosures made through such Electronic Health Record for Treatment, Payment and Health Care Operations, as applicable. Business Associate’s accounting must comply with the requirements of the HITECH Act. Upon request by Covered Entity, Business Associate must provide the accounting to Covered Entity in the time and manner specified by Covered Entity and in compliance with the HITECH Act. Alternatively, if Covered Entity responds to an Individual’s request for an accounting of Disclosures made through an Electronic Health Record by providing the requesting Individual with a list of all business associates acting on behalf of Covered Entity, then Business Associate must provide the accounting directly to the requesting Individual in the time and manner specified by the HITECH Act.

f. Agreement to Restrict Disclosure. If Covered Entity is required to comply with a restriction on the Disclosure of PHI pursuant to Section 13405 of the HITECH Act, then Covered Entity will, to the extent necessary to comply with the restriction, provide written notice to Business Associate of the name of the Individual requesting the restriction and the PHI affected thereby. Upon receipt of notification, Business Associate must not Disclose the identified PHI to any health plan for the purposes of carrying out Payment or Health Care Operations, except as otherwise required by law. Covered Entity will also notify Business Associate of any other restriction to the Use or Disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522. Business Associate agrees to comply with any restrictions accepted by the Covered Entity regarding an individual’s PHI in a manner consistent with 45 C.F.R.

§164.522, except where Use or Disclosure is required under applicable law.

6. Remuneration and Marketing.

a. Remuneration of PHI. This Section 6.a is effective with respect to exchanges of PHI occurring six (6) months after the date of the promulgation of final regulations implementing the provisions of Section 13405(d) of the HITECH Act. On and after that date, Business Associate agrees it may not, directly or indirectly, receive remuneration in exchange for any PHI of Covered Entity except as otherwise permitted by the HITECH Act. Business Associate further agrees to comply with all other requirements contained in the “Prohibition on Sale of Electronic Health Records and Protected Health Information,” as provided in Section 13405(d) of Subtitle D of ARRA, the “Conditions on Certain Contracts as Part of Health Care Operations,” as provided in Section 13406 of Subtitle D of ARRA and all related guidance issued by the Secretary periodically.

7. Governmental Access to Records. Business Associate must make its internal practices, books, and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining Covered Entity’s compliance with the HIPAA Regulations and the HITECH Act. Except to the extent prohibited by law, Business Associate agrees to notify Covered Entity of all requests served upon Business Associate for information or documentation by or on behalf of the Secretary. Business Associate must provide Covered Entity a copy of any PHI that Business Associate provides to the Secretary concurrently with providing the PHI to the Secretary.

8. Minimum Necessary. To the extent required by the HITECH Act, Business Associate must limit its Use, Disclosure, or request of PHI to the Limited Data Set or, if needed, to the minimum necessary to accomplish the intended Use, Disclosure, or request, respectively.

Effective on the date the Secretary issues guidance on what constitutes “minimum necessary” for purposes of the HIPAA Regulations, Business Associate must limit its Use, Disclosure, or request of PHI to only the minimum necessary as set forth in the guidance.

9. State Privacy Laws. Business Associate must comply with state laws to extent that state privacy laws are not preempted by HIPAA or the HITECH Act.

10. Termination.

a. Breach by Business Associate. If Covered Entity knows of a pattern of activity or practice of Business Associate that constitutes a material breach or violation of Business Associate’s obligations under this Agreement, then Covered Entity will promptly notify Business Associate. With respect to such breach or violation, Business Associate must take reasonable steps to cure any breach or end any violation, if possible. If steps are either not possible or are unsuccessful, upon written notice to Business Associate, Covered Entity may terminate its relationship with Business Associate.

b. Breach by Covered Entity. If Business Associate knows of a pattern of activity or practice of Covered Entity that constitutes a material breach or violation of Covered Entity’s obligations under this Agreement, then Business Associate must promptly notify Covered Entity. With respect to such breach or violation, Covered Entity must take reasonable steps to cure the breach or end the violation, if possible. If steps are either not possible or are unsuccessful, upon written notice to Covered Entity, Business Associate may terminate its relationship with Covered Entity.

c. Effect of Termination. Upon termination of this Agreement for any reason, Business Associate must either return or destroy all PHI, as requested by Covered Entity, that Business Associate or its agents or subcontractors still maintain in any form and may not retain any copies of the PHI. If Covered Entity requests that Business Associate return PHI, the PHI must be returned in a mutually agreed upon format and timeframe. If Business Associate reasonably determines that return or destruction is not feasible, Business Associate must continue to extend the protections of this Agreement to the PHI, and limit further uses and disclosures of PHI to those purposes that make the return or destruction of the PHI not feasible. If Business Associate is asked to destroy the PHI, Business Associate must destroy PHI in a manner that renders the PHI unusable, unreadable, or indecipherable to unauthorized persons as specified in the HITECH Act.

11. Amendment. The parties acknowledge that state and federal laws relating to data security and privacy are rapidly evolving and that amendment of this Agreement may be required to ensure compliance with developments. The parties specifically agree to take necessary action to implement any new or modified standards or requirements of HIPAA, the HIPAA Regulations, the HITECH Act and other applicable laws relating to the security or confidentiality of PHI. Upon the request of Covered Entity, Business Associate agrees to promptly enter into negotiation concerning the terms of an amendment to this Agreement incorporating any changes.

12. No Third Party Beneficiaries. Nothing express or implied in this Agreement confe r s , o r is intended to confer, any rights, remedies, obligations, or liabilities whatsoever upon any person other than Covered Entity, Business Associate, and their respective successors or assigns.

13. Effect on Underlying Agreements. In the event of any conflict between this Agreement and the Underlying Agreements, the terms of this Agreement control.

14. Survival. The provisions of this Agreement survive the termination or expiration of the Underlying Agreements.

15. Interpretation. This Agreement is intended to be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA Regulations and the HITECH Act. The parties agree that any ambiguity in this Agreement be resolved in favor of a meaning that complies and is consistent with these laws.

16. Governing Law. This Agreement is governed by and construed in accordance with the laws of the Commonwealth of Kentucky, without reference to its choice of law rules, may be executed in counterpart copies, and, in the absence of an original signature, electronic or faxed signatures are considered the equivalent of an original signature. The Kenton County Airport Board and Business Associate agree that any legal or equitable action for claims, debts or obligations arising out of or related to this Agreement must be brought solely in the Circuit Court of Boone County, Kentucky or United States District Court for the Eastern District of Kentucky, Covington Division, and that either Court has personal jurisdiction over the parties and venue of the action is appropriate in each Court. If a provision of this Agreement is held invalid under any applicable law, the invalidity will not affect any other provision of this Agreement that can be given effect without the invalid provision. Further, all terms and conditions of this Agreement will be deemed enforceable to the fullest extent permissible under applicable law, and when necessary, the court is requested to reform any and all terms or conditions to give them full effect.

17. Notices. All notices required or permitted under this Agreement must be in writing and sent to the other party as directed below or as otherwise directed by either party, from time to time, by written notice to the other. All notices are deemed validly given upon receipt of the notice by certified mail, postage prepaid, facsimile transmission, e-mail, or personal or courier delivery:

If to Covered Entity: Kenton County Airport Board

P.O. Box 752000 Cincinnati, OH 45275-2000 Attn: Chief Executive Officer

If to Business Associate: _______________________________________

18. Electronic Signatures and Delivery. The Parties consent to the use of both manual and electronic signatures to execute this Agreement, and any subsequent amendments, extensions, change orders, or other agreements, to the same legal effect and extent as if entirely manually signed. Electronic delivery of any counterpart of this Agreement is as effective and legally binding as physical delivery with all counterparts constituting one agreement.

THE COVERED ENTITY BUSINESS ASSOCIATE

KENTON COUNTY AIRPORT BOARD ________________________________

By: By:

Its: Chief Executive Officer

Its: __________________

Attest:

Secretary/ Treasurer