RFQS_1100_DCM4010_ATT_2_v1.pdf

HIPAA Business Associate Agreement - RFQS 1100 DCM4010 Page 1 of 5

HIPAA BUSINESS ASSOCIATE CERTIFICATION

CITY OF AUSTIN

AUSTIN FINANCIAL SERVICES – CENTRAL PROCUREMENT

This Certification is made by the person or entity identified in the signature block below (the “Business Associate”), and is made with reference to the following facts:

i. The Program is subject to the privacy and other requirements of the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”);

ii. Under the HIPAA Rules (defined below), the City of Austin (“City”) is required to obtain written agreement from the Business Associate with the terms and conditions provided below; and

iii. The Business Associate makes this Certification in order to comply with the HIPAA Rules (defined below), and to safeguard Protected Health Information (defined below) appropriately.

Therefore, the Business Associate Certifies the following:

1. Definitions. As used in this Certification:

A. “HIPAA Rules” and/or “HIPAA” shall mean the Privacy, Security, Breach Notification, and Enforcement

Rules implementing HIPAA and set out at 45 CFR Part 160 and Part 164.

B. “Individually Identifiable Health Information” shall mean information collected from an individual, including demographic information, that:

i. Is created or received by the City and provided to the Business Associate; and

ii. Relates to: (a) the past, present, or future physical or mental health or condition of an individual; (b) the provision of healthcare to an individual; or (c) the past, present, or future payment for the provision of healthcare to an individual; and

iii. Which identifies the individual, or with respect to which there is a reasonable basis to believe the information can be used to identify the individual.

C. “Protected Health Information” shall mean Individually Identifiable Health Information that is: (i) transmitted by electronic media; (ii) maintained in any medium constituting electronic media; or (iii) transmitted or maintained in any other form or medium.

D. “Agent” and “Subcontractor” shall mean a third party who is not an employee in the workforce of the Business Associate and who receives Protected Health Information from the Business Associate for purposes of carrying out any part of the Business Associate’s responsibilities under its services agreement with the City.

E. “Business Associate” shall have the same meaning as the term “business associate” set out at 45 CFR Part 160.103.

2. The Business Associate Certifies to Permitted Uses and Disclosures of Protected Health Information as Follows:

A. The Business Associate shall only use or disclose Protected Health Information for the following purposes:

(i) to receive and process claims for payment for eligible Program participants; (ii) to maintain claims history and patient profiles; (iii) to maintain current eligibility data on Program participants; and (iv) for the management and administration of its internal business processes that relate to its legal responsibilities and its responsibilities under the services contract between the City and the Business Associate.

B. The Business Associate shall only use or disclose Protected Health Information as required by law.

C. The Business Associate shall make its internal practices, books, and records, including policies and procedures, relating to the use and disclosures of Protected Health Information available to the Secretary of the United States Department of Health and Human Services for purposes of determining compliance with HIPAA.

HIPAA Business Associate Agreement - RFQS 1100 DCM4010 Page 2 of 5

D. Within ten (10) calendar days of receipt of a request by the City, the Business Associate shall permit any individual whose Protected Health Information is maintained by the Business Associate to have access to and to copy his or her Protected Health Information, in the format requested, unless it is not readily producible in such format, in which case it shall be produced in hard copy format. In the event any individual requests access to Protected Health Information held by the Business Associate directly from the Business Associate, the Business Associate shall, within two (2) days forward such request to the City.

3. The Business Associate Certified to Prohibitions on Use and Disclosure of Protected Health Information as Follows:

A. The Business Associate shall not use or further disclose Personal Health Information except as permitted or required by law.

B. The Business Associate shall not sell Protected Health Information, including patient or enrollee lists, nor use any Protected Health Information to engage in “marketing,” as that term is defined in 45 CFR Part 164.501

C. The Business Associate shall not disclose Personal Health Information to any member of its workforce unless the Business Associate has advised such person of the Business Associate’s obligations under this Certification and of the consequences for such person and for the Business Associate of violating them.

D. The Business Associate shall not disclose Personal Health Information to any Agent, Subcontractor or other third party unless disclosure is required by law, or unless expressly approved in advance by the City in writing. Any such disclosure shall be made in accordance with 45 CFR Parts 164.502 and 164.308, and only upon the written agreement of the Agent, Subcontractor or other third party which shall include, at a minimum:

i. The agreement of such Agent, Subcontractor or other third party that creates, receives, maintains, or transmits protected health information on behalf of the Business Associate to be bound to the same restrictions, conditions and requirements that apply to Business Associate with respect to such information;

ii. Reasonable assurances from such Agent, Subcontractor or other third party that Personal Health Information will be held confidential as the Business Associate certifies to do in this Certification, and only disclosed as required by law or for the purposes for which it was disclosed to such Agent, Subcontractor or other third party; and

iii. An agreement from such Agent, Subcontractor or other third party to immediately notify the Business Associate of any breaches of the confidentiality of Personal Health Information, to the extent it has obtained knowledge of such breach.

4. The Business Associate Certifies to Safeguards for Protected Health Information as Follows:

A. The Business Associate shall implement appropriate safeguards to prevent use or disclosure of Personal Health Information other than as stated in this Certification. The Business Associate shall provide the City with information concerning such safeguards as the City may from time-to-time request. Upon reasonable request, the Business Associate shall give the City access for inspection and copying to the Business Associate’s facilities used for the maintenance and processing of Personal Health Information, and to its books, records, practices, policies, and procedures concerning the use and disclosure of Personal Health Information.

B. The Business Associate and any Agent or Subcontractor shall comply with the minimum necessary requirements set forth in the HIPAA Rules when using or disclosing Personal Health Information. The Business Associate also agrees to mitigate, to the extent possible, any harmful effects of an improper use or disclosure of Personal Health Information by the Business Associate in violation of the guarantees of this Certification. The Business Associate shall make its internal practices, books, records, including policies and procedures, related to the use and disclosures of protected health information available to the Secretary of the United States Department of Health and Human Services, for purposes of determining

HIPAA Business Associate Agreement - RFQS 1100 DCM4010 Page 3 of 5 compliance with HIPAA.

C. The Business Associate shall maintain a record of all Personal Health Information disclosures made other than for the permitted purposes of this Agreement, including the date of disclosure, the name and, if known, the address of the recipient of the Personal Health Information, a brief description of the Personal Health Information disclosed, and the purposes of the disclosures.

D. The Business Associate shall comply with all written directions from the City concerning:

i. any special limitations on the use or disclosure of Protected Health Information beyond the requirements of the HIPAA Rules;

ii. any changes in, or revocation of, the permission by an individual to use or disclose his or her Protected Health Information that may affect the Business Associate’s use or disclosure of such information; and

iii. any restriction on the use or disclosure of Protected Health Information that the City has agreed to that may affect the Business Associate’s use or disclosure of such information.

E. Within ten (10) calendar days of notice by the City to the Business Associate that the City has received a request for an accounting of disclosures of Personal Health Information regarding an individual, the Business Associate shall make available to the City such information as is in the Business Associate’s possession and is required for the City to make the accounting.

F. Within five (5) business days of becoming aware of a use or disclosure of Personal Health Information in violation of this Certification by the Business Associate, Agent or Subcontractor, the Business Associate shall report such disclosure or use in writing to the City and describe the remedial action taken or proposed to be taken with respect to such use or disclosure.

G. The Business Associate shall make any amendment(s) to Protected Health Information in a designated record set as directed or agreed to by the City pursuant to 45 CFR Part 164.526 or take other measures as necessary to satisfy the City’s obligations under 45 CFR Part 164.526.

H. The Business Associate acknowledges that the additional requirements of the HITECH Act (Health Information Technology for Economic and Clinic Health Act enacted as part of the American Recovery and Reinvestment Act of 2009) and the Final Rule (also known as the Omnibus Rule) issued by the U.S.

Department of Health and Human Services on January 25, 2013 are applicable to the Business Associate.

The Business Associate further acknowledges restrictions on the sales and marketing of protected health information without the explicit authorization of the individual.

I. To the extent the Business Associate is to carry out one of more of the City’s obligations under Subpart E of 45 C.F.R. Part1 164, the Business Associate will comply with the requirements of Subpart E that apply to the City in the performance of such obligations.

J. The Business Associate may not use or disclose protected health information in a manner that would violate Subpart E of 45 C.F.R. Part 164 if done by the City except for the specific uses and disclosures set forth below:

i. The Business Associate may disclose protected health information for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided the disclosures are required by law, or the Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information remains confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances in which it is aware in which the confidentiality of the information has been breached.

ii. The Business Associate may provide data aggregation services related to the health care operations of the City.

5. Duration of this Certification; Procedures upon Expiration.

HIPAA Business Associate Agreement - RFQS 1100 DCM4010 Page 4 of 5

A. This Certification shall become effective upon signature of an authorized representative of the Business Associate.

B. This Business Associate shall ensure compliance with this Certification for the term on the underlying contract it has with the City, necessitating this Certification.

C. Except as provided in paragraph D, below, upon termination of the underlying contract, the Business Associate shall return or destroy all Personal Health Information received from the City, or created or received by the Business Associate on behalf of the City. This provision shall also apply to Personal Health Information that is in the possession of Agents or Subcontractors of the Business Associate. The Business Associate shall retain no copies of the Personal Health Information.

D. In the event that the Business Associate determines that returning or destroying the Personal Health Information is not feasible, the Business Associate shall provide to the City written notification of the conditions that make return or destruction infeasible. Upon agreement by the City that return, or destruction of Personal Health Information is not feasible, the Business Associate shall extend the protections of this Certification to such Personal Health Information and limit further uses and disclosures of such Personal Health Information to those purposes that make the return or destruction infeasible, for so long as the Business Associate maintains the Personal Health Information. The Business Associate shall continue to use appropriate safeguards and comply with Subpart C of 45 C.F.R. Part 164 with respect to electronic protected health information to prevent use or disclosure of the protected health information, other than as provided for in this Section, for as long as Business Associate retains the protected health information.

E. The Business Associate shall not use or disclosure the protected health information retained by the Business Associate other than for the purposes for which the protected health information was retained and subject to the same conditions set out in this Certification which applied prior to termination of the underlying contract.

F. Survival. The obligations of the Business Associate under this Section shall survive the termination of the underlying contract and the expiration of this Certification.

6. The Business Associate Certifies to Also:

A. Indemnification. The Business Associate shall indemnify and hold harmless the City from and against any and all costs, liabilities, losses, damages, and expenses (including, but not limited to, reasonable attorneys’ fees) resulting from any claim, lawsuit or proceeding brought by a third party against the City and arising from or related to a breach or alleged breach by the Business Associate or the Business Associate’s Agents or Subcontractors of the obligations referenced herein. The Business Associate’s obligation to indemnify shall survive the expiration of this Certification.

B. Remedies for Breach. Without limiting the rights of the parties under paragraph 5, should the Business Associate breach any of its obligations of this Certification, the City may at its option: (i) exercise its rights of access and inspection under paragraph 2, above; and/or (ii) report the breach to the Secretary of the United States Department of Health and Human Services.

C. Notices. Any notice required or provided for under this Certification shall be effective upon delivery via regular or electronic mail to the following addresses:

To the City: To the Business Associate:

Name: To be provided at Contract Kick-off Meeting Name:

Phone: To be provided at Contract Kick-off Meeting Phone:

Email: To be provided at Contract Kick-off Meeting Email:

D. Amendments. Upon the enactment of any law or regulation affecting the use or disclosure of protected health information, or the publication of any decision of a court of the United State or State of Texas relating to any such law, or the publication of any interpretive policy or opinion of any governmental agency charged with the enforcement of any such law or regulation, the City may, by written notice to the Business

HIPAA Business Associate Agreement - RFQS 1100 DCM4010 Page 5 of 5

Associate, require an updated Certification in such a manner as the City determines necessary to comply with such law or regulation. Notwithstanding the foregoing, if the City has not required an updated Certification to address a law or final regulation that becomes effective after the effective date of this Certification and that is applicable to this Certification, then upon the effective date of such law or regulation (or any portion thereof) this Certification shall be amended automatically and deemed to incorporate such new or revised provisions as are necessary for this Certification to be consistent with such law or regulation for the City and the Business Associate to be and remain in compliance with all applicable laws and regulations.

E. Construction of Terms. A reference in this Certification to a section in the HIPAA Rules means the section in effect or as amended at the time of signature by the Business Associate. Any ambiguity in this Certification shall be interpreted to permit compliance with the HIPAA Rules.

The Business Associate certifies that all of the above is true and shall be complied with during the term of the underlying contract and as required to survive, as stated above:

THE BUSINESS ASSOCIATE:

Signature of Authorized Representative

Printed Name

Title

Organization

Date