RFQ-IT_HD159073_Addendum_2_Exhibit_E--HIPAA.pdf

RFQ-IT HD159073

Sample Contract

EXHIBIT E

Statement of Assurances for Protection of Personal Information

Health Insurance Portability and Accountability Act (HIPAA) Health Information Technology for Economic and Clinical Health (HITECH)

State Administrative Manual (SAM)

1. Background

The Health Insurance Portability and Accountability Act of 1996 (hereinafter HIPAA) Privacy and Security Regulations (45 C.F.R. Subpart A, Subchapter C, Part 164, Subpart E) establish standards to protect the security and privacy of individually identifiable health information created, maintained, or transmitted for the purpose of providing or paying for health care.

Under this regulation, it is necessary that the State establish written agreements with contractors who create, receive, maintain or transmit individually identifiable health information on behalf of the State to assure that said contractors will safeguard such information in accordance with the requirements of the 45 C.F.R. Subpart A, Subchapter C, Part 164, Subpart C and Subpart E.

The Health Information Technology for Economic and Clinical Health Act, (Public Law 111- 005, 42 U.S.C. Section 17921 et seq.,) (hereinafter HITECH), a part of the American Recovery and Reinvestment Act of 2009 (ARRA) includes broad new requirements for privacy and security that impact HIPAA covered entities and business associates.

The State Administrative Manual (hereinafter SAM) sections 5300.3 through 5345.2 require the State to classify data and to maintain the integrity and security of its automated information.

SAM Section 5310 requires that State agencies establish agreements with non-state entities to establish appropriate policies and procedures for preserving the integrity and security of automated files and data bases. This includes the identification of appropriate levels of confidentiality based on data classification. Policy for data classification is in SAM section

5320.5 and defines confidential, sensitive and personal information. Under this policy, personal information includes protected health information and individually identifiable health information transmitted by or maintained in electronic media.

2. Contract Practices

For purposes of this Agreement, Contractor agrees to carry out the requirements set forth by the HIPAA Security and Privacy Regulations for business associates as well as the requirements set forth by HITECH and the SAM.

The contractor acknowledges the application of security and provisions and the application of civil and criminal penalties shall apply to a business associate of a covered entity (42 USC §17931 (HITECH § 13401) and 42 USC § 17934 (HITECH § 13404)).

The following portions of HITECH override HIPAA privacy and security regulations, became effective on February 18, 2010, and shall be agreed to be the Contractor:

Covered Entities will be responsible to follow the restrictions on certain disclosures and sales of health information; responsible for the accounting of certain protected health information disclosures and be required to provide certain information in electronic format if available.

Covered entities must comply with an individuals request to restrict disclosure of personal health information to a health plan provider if the provider has been paid out of pocket in full.

Covered entities will be in compliance with Minimum Necessary sections of the HIPAA Privacy Regulations (164.502(b)(1)) if they limit disclosures to the Limited Data Set. Individuals have a right to receive an electronic copy of their Protected Health Information (PHI) from a Covered Entity if it is maintained in an electronic health record. 42 USC § 17935 (HITECH §13405)

Communications (by a covered entity or a business associate) that encourage purchasing a product or service are excluded from the HIPAA definition of Health Care Operations, with certain exceptions. 42 USC § 17936 (HITECH § 13406)

Persons or organizations, collectively referred to as “covered entities,” may be subject to civil money penalties and criminal penalties for violations of HIPAA rules. Health and Human Services (HHS) enforces the civil money penalties under section 1176 of the Act, and the U.S.

Department of Justice enforces the criminal penalties under section 1177 of the Act. Section 1177(a) of the Social Security Act (42 U.S.C. 1320d-6(a)) is amended by adding at the end the following new sentence: "For purposes of the previous sentence, a person (including an employee or other individual) shall be considered to have obtained or disclosed individually identifiable health information in violation of this part if the information is maintained by a covered entity (as defined in the HIPAA privacy regulation described in section 1180(b)(3)) and the individual obtained or disclosed such information without authorization.". 42 USC § 1320d-

6 (HITECH § 13409)

All information and records obtained in the course of providing intake, assessment and services to persons with developmental disabilities shall be confidential (California Welfare and Institutions Code sections 4514 and 5328)

3. Definitions

The following definitions shall apply to the terms used in this Agreement:

Personal Information is information that identifies or describes an individual including, but not limited to, the following:

A. Notice-triggering personal information, defined as specific items or personal information (name plus Social Security Number, driver's license/California identification card number, or financial account number) that may trigger a requirement to notify individuals if an unauthorized person acquires it. [Civil Code Sections 1798.29 and 1798.3];

B. Protected Health Information, defined as individually identifiable information created, received, or maintained by such organizations as health care payers, health care providers, health plans, and contractors to these entities, in electronic or physical form. [Confidentiality of Medical Information Act, Civil Code Section 56 et seq.];

[Patients' Access to Health Records Act, Health and Safety Code Sections 123100-123149.5];

[Health Insurance Portability and Accountability Act, 45 C.F.R. parts 160 and 164];

C. Electronic Health Information, defined as individually identifiable health information transmitted by electronic media or maintained in electronic media. [Health Insurance Portability and Accountability Act, 45 C.F.R. parts 160 and 164].

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 C.F.R Part 160 and Part 164 of the implementing regulations HIPAA and those terms in SAM.

4. Uses and Disclosures of Personal Information

Except as otherwise provided in this Agreement, Contractor may use or disclose personal information to perform functions, activities or services for, or on behalf of, the State as specified in the contract, provided that such use or disclosure does not violate the HIPAA Security and Privacy Regulations if done by the State or the minimum necessary policies and procedures of the State or the minimum necessary policies and procedures of the state. [45 C.F.R. §164.504(e)(2)(i)]

Except as otherwise limited in this Agreement, Contractor may disclose personal information for the proper management and administration of the Contractor provided that disclosures are required by law, or Contractor obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Contractor of any instances of which it is aware in which the confidentiality of the information has been breached. [45 C.F.R. §164.504(e)(4)]

Contractor may use personal information to report violations of law to the appropriate federal and state authorities consistent with 45 C.F.R. §164.502(j).

5. Further Disclosure of Personal Information

Contractor shall not use or further disclose personal information other than as permitted or required by this Agreement, or as required by law. [45 C.F.R. §164.504(e)(2)(ii)(A)]

6. Safeguarding Personal Information

Contractor shall use appropriate safeguards to prevent use or disclosure of personal information other than as provided for by this Agreement.

[45 C.F.R. §164.504(e)(2)(ii)(B)]

Contractor shall implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of the electronic personal information it creates, receives, maintains, or transmits in an electronic format on behalf of the State. [45 C.F.R. §164.314(a)(2)(i)(A)]

Contractor shall ensure appropriate levels of confidentiality for the data based on data classification. [SAM 5320.5]

Contractor shall require that if a data file is downloaded to a mobile device or desktop computer from another computer system, the specifications for information integrity and security which have been established for the original data file must be applied in the new environment. [SAM 5310]

Contractor shall require encryption of State data that is confidential, sensitive, and personal when it is stored or transmitted using portable computing devices (including, but not limited to, laptops and notebook computers) and/or portable electronic storage media. [SAM 5310]

Contractor shall apply security patches and upgrades, and keep virus software up-to-date on all systems on which data may be used. [SAM 5310]

Contractor shall comply, as appropriate, with all Department of Developmental Services Information Security Policies supplied to them by DDS. [SAM 5310]

7. Uses and Disclosures of Personal Information Not Provided for by this

Agreement

Contractor shall report to the State any use, disclosure, or security incident involving personal information of which it becomes aware that is not provided for by this Agreement. [45 C.F.R.

§164.504(e)(2)(ii)(C)]; [45 C.F.R. §164.314(a)(2)(i)(C)]; and [SAM 5310]

Contractor shall mitigate, to the extent practicable, any harmful effect that is known to the Contractor of a use or disclosure of personal information by the contractor in violation of the requirements of this Agreement. [45 C.F.R. §164.530(f)]

8. Agents and Subcontractors

Contractor shall ensure that any agent, including a subcontractor, to whom the Contractor provides personal information received from, or created or received by the Contractor on behalf of the State, agrees to the same restrictions and conditions that apply through this Agreement to the Contractor with respect to such information. [45 C.F.R. §164.504(e)(2)(ii)(D)]

Contractor shall ensure that any agent, including a subcontractor, to whom it provides personal information received from, or created or received by the Contractor on behalf of the State in electronic format, agrees to implement reasonable and appropriate safeguards to protect the electronic personal information. [45 C.F.R. §164.314(a)(2)(i)(B)]

9. Access To Personal Information

Contractor shall provide access, at the request of the State, and in the time and manner designated by the State, to personal information in a designated record set to the State or, as directed by the State, to an Individual in order to meet the requirements of 45 C.F.R. §164.524.

[45 C.F.R. §164.504(e)(2)(ii)(E)]

10. Amendments To The Designated Record Sets

Contractor shall make any amendment(s) to personal information in a designated record set that the State directs or agrees to pursuant to 45 C.F.R. §164.526 at the request of the State or an individual, and in the time and manner designated by the State. [45 C.F.R.

§164.504(e)(2)(ii)(F)]

11. Documentation and Accounting of Disclosures

Contractor shall document disclosures of personal information and information related to such disclosures as would be required for the State to respond to a request by an Individual for an accounting of disclosures of personal information in accordance with 45 C.F.R. §164.528. [45 C.F.R., §164.504(e)(2)(ii)(G)]

Contractor shall provide to the State or an Individual, in the time and manner designated by the State, information collected in accordance with 45 C.F.R. §164.528, to permit the State to respond to a request by the Individual for an accounting of disclosures of personal information in accordance with 45 C.F.R. §164.528. [45 C.F.R. §164.504(e)(2)(ii)(G)]

12. Records Available To The State and Secretary

Contractor shall make its internal practices, books and records relating to the use and disclosure of personal information received from the State, or created or received by the Contractor on behalf of the State, available to the State or to the Secretary of the United States Department of Health and Human Services for purposes of investigating or auditing the State’s compliance with the HIPAA privacy requirements, in the time and manner designated by the State or the Secretary. [45 C.F.R. §164.504(e)(ii)(2)(H)]

13. Personnel Designation

Contractor shall designate a compliance official to be responsible for developing and implementing procedures necessary to carry out the contractor’s obligations under this agreement.

Contractor shall designate an official to provide a signed confidentiality statement. [SAM 5310]

14. Term and Termination

A. Term

The Term of this Agreement shall terminate when all of the personal information provided by the State to the Contractor, or created or received by the Contractor on behalf of the State, is destroyed or returned to the State.

[45 C.F.R.§164.505(e)(2)(iii)]; [45 C.F.R. §164.314(a)(2)(i)(D)]

B. Termination for Cause

Upon the State’s knowledge of a pattern of activity or practice by the Contractor that constitutes a violation of this Agreement by the Contractor, State shall either: (1) take reasonable steps to provide an opportunity for the Contractor to end the violation, and shall terminate this Agreement if Contractor does not end the violation within the time specified by the State; (2) immediately terminate this Agreement if Contractor has breached a material term of this Agreement and cure is not possible; or (3) report the violation to the Secretary if such cure is not possible.

C. Effect of Termination

Upon termination of this contract for any reason, Contractor shall return or destroy all personal information received from the State, or created or received by the Contractor on behalf of the State. This provision shall apply to personal information in possession of subcontractors or agents of the Contractor. Contractor, its agents or subcontractors shall retain no copies of the personal information.

In the event Contractor determines that returning or destroying the personal information is not feasible, the Contractor shall provide the State notification of the conditions that make return or destruction not feasible. If the State agrees that the return of the personal information is not feasible, the Contractor shall extend the protections of this Agreement to such personal information and limit further use and disclosures of such personal information to those purposes that make the return or destruction infeasible, for so long as the Contractor, or any of its agents or subcontractors, maintains such personal information. [45 C.F.R.

§164.504(e)(2)(ii)(I)]

15. Miscellaneous

A reference in this Agreement to the Privacy and/or Security Regulation means as in effect or as amended.

The parties agree to take such action as is necessary to amend this Agreement from time to time as necessary for the State to comply with the requirements of the HIPAA Security and Privacy Regulations and with the requirement of SAM.

The respective rights and obligations of the Contractor under 14, Term and Termination, of this agreement, shall survive the termination of this Agreement.

Any ambiguity in this Agreement shall be resolved to permit the State to comply with the HIPAA Security and Privacy Regulations and with the requirements of SAM.

References:

United States Department of Health and Human Services, Office for Civil Rights, Medical Privacy - National Standards to Protect the Privacy of Personal Health Information http://hhs.gov/ocr/hipaa

United States Department of Health and Human Services, Centers for Medicare and Medicaid Services – Security Standards http://www.cms.hhs.gov/SecurityStandard/

State Administrative Manual - http://sam.dgs.ca.gov/ http://hhs.gov/ocr/hipaa http://www.cms.hhs.gov/SecurityStandard/ http://sam.dgs.ca.gov/

CONFIDENTIALITY AGREEMENT

Required for Release of DDS Data per the State Administrative Manual Section (5310)

I hereby acknowledge that Department of Developmental Services (DDS) records and documents are subject to strict confidentiality requirements imposed by State and Federal laws including California Welfare and Institutions Code sections 4514, 5328, and 15600 et seq; California Penal Code 11167.5; and the Health Insurance Portability and Accountability Act of 1996 Parts 160 and 164.

I assure that the appropriate provisions of both State and Federal law have been met by my organization and further assure that all agents of my organization, including subcontractors, understand that unauthorized use, dissemination or distribution of DDS personal information is a crime and that breaches of confidentiality and security are subject to civil and criminal penalties.

I assure that agents, including subcontractors, of my organization will not use, disseminate or otherwise distribute records or documents containing DDS personal information, either on paper or by electronic means, other than as required in the performance of their duties per this contract.

I agree that unauthorized use, dissemination or distribution of DDS records, documents or information is grounds for immediate termination of my organization’s contract with the DDS and may subject me to penalties, both civil and criminal.

____________________________________________ Date: ____________ Signature

Name/Title (Print)