Sample 2015 Business Associate Agreement BAAv1.doc

COUNTY OF MARATHON

BUSINESS ASSOCIATE AGREEMENT

THIS BUSINESS ASSOCIATE AGREEMENT (“Agreement”) is entered into as of ______________, 20__ (“Effective Date”), by and between the County of Marathon, City of Wausau, North Central Health Care and City-County IT Commission (the “Covered Entity”) and __________________ (“Business Associate”).

Background

A.

The Covered Entity has engaged the Business Associate to perform services for the Covered Entity (hereafter, referred to as “Services”), in the course of providing Services, Business Associate is likely to obtain and/or maintain, use or disclose Protected Health Information (as defined below) provided to it by the Covered Entity; and

C.

The parties desire to enter into this Agreement in compliance with the business associate agreement requirements of HIPAA;

NOW, THEREFORE, the parties do hereby agree as follows:

1. Definitions.

1.1. “Breach” shall have the same meaning as the term “breach” at 45 CFR § 164.402.

1.2. “Business Associate” shall have the same meaning as the term “Business Associate” in 45 CFR §160.103, and in reference to the party to this agreement, shall mean [insert name of BA].

1.3. “Covered Entity” shall have the same meaning as the term “Covered Entity” at 45 CFR § 160.103, and in reference to the party to this Agreement, shall mean the County of Marathon.

1.4. “Electronic Protected Health Information” shall have the same meaning as the term “electronic protected health information” at 45 CFR § 160.103, limited to the information created, received, or maintained by Business Associate from or on behalf of the Covered Entity.

1.5. “HIPAA” shall mean the Health Insurance Portability and Accountability Act of 1996

1.6. “HIPAA Rules” shall mean the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Part 160 and Part 164.

1.7. “Privacy Rule” shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Part 160 and Part 164, Subparts A and E.

1.8. “Protected Health Information” or “PHI” shall have the same meaning as the term “protected health information” at 45 CFR § 160.103, limited to the information created, received, or maintained by Business Associate from or on behalf of the Covered Entity.

1.9. “Security Incident” shall have the same meaning as the term “security incident” at 45 CFR 164.304.

1.10. “Security Rule” shall mean Security Standards for the Protection of Electronic Protected Health Information, at 45 CFR Part 160 and Part 164, Subpart C.

1.11. “Unsecured Protected Health Information” or “Unsecured PHI” shall have the meaning given the term “unsecured protected health information at 45 CFR § 164.402.

1.12. Capitalized terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the HIPAA Rules.

2. Obligations of Business Associate. Business Associate acknowledges and agrees that pursuant to the HIPAA Rules, Business Associate is considered a Business Associate. As a Business Associate, Business Associate shall, in addition to complying with the other terms and conditions of this Agreement, comply with the HIPAA Rules set forth in this Section and any provisions of applicable state law that are more restrictive.

2.1. Use and Disclosure. Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform functions and activities on the Covered Entity’s behalf, as described in this Agreement or pursuant to the applicable services agreement, and to conduct normal Business Associate operations as described in this Agreement. Business Associate shall not use or further disclose PHI for any other purpose, except as required by law or as expressly consented to by the Covered Entity in writing.

2.2. Business Associate’s Operations. For Business Associate’s proper management and administration or to carry out Business Associate’s legal responsibilities, provided that, with respect to disclosure of the Covered Entity’s PHI, either:

(a) The disclosure is required by law; or

(b) Business Associate obtains reasonable assurance from any person or entity to which Business Associate will disclose Covered Entity’s PHI that the person or entity will:

(i) Hold Covered Entity’s PHI in confidence and use or further disclose Covered Entity’s PHI only for the purpose for which Business Associate disclosed Covered Entity’s PHI to the person or entity or as required by law; and

(ii) Promptly notify Business Associate (who will in turn notify Covered Entity in accordance with the Breach notification provisions) of any instance of which the person or entity becomes aware in which the confidentiality of Covered Entity’s PHI was breached.

2.3. Minimum Necessary. Pursuant to Section 2.1 of this Agreement, the Business Associate will, in its performance of the functions, activities, services and operations specified in this Agreement, make reasonable efforts to use, to disclose and to request only the minimum amount of Covered Entity’s PHI reasonably necessary to accomplish the intended purpose of the use, disclosure or request, except that Business Associate will not be obligated to comply with this minimum-necessary limitation if neither Business Associate or Covered Entity is required under the HIPAA Rules to limit its use, disclosure or request to the minimum necessary. Business Associate and Covered Entity acknowledge that the phrase “minimum necessary” shall be interpreted in accordance with the Health Information Technology for Economic and Clinical Health Act (“HITECH Act”) passed as part of the American Recovery and Reinvestment Act of 2009 (“ARRA”), and government guidance of the definition.

2.4. Safeguard PHI. Business Associate agrees to use appropriate safeguards to prevent use or disclosure of the PHI other than as provided for by this Agreement, including establishing procedures that limit access to PHI within its organization to those employees who have a need to know the information. Business Associate agrees that it will implement reasonable administrative, physical and technical safeguards to protect the confidentiality, integrity and availability of electronic PHI that it creates, receives, maintains or transmits on behalf of the Covered Entity, as required by the HIPAA Rules.

The requirements of 45 CFR Sections 164.308, 164.310 and 164.312 applicable to such administrative, physical and technical safeguards shall apply to Business Associate in the same manner that such sections apply to Covered Entity. Further, as described in this Agreement, Business Associate shall implement, and maintain in written form reasonable and appropriate policies and procedures to comply with the standards, implementation specifications or other requirements of the HIPAA Rules, which shall apply to Business Associate in the same manner that such sections apply to Covered Entity.

2.5. Reporting Unauthorized Disclosures of PHI. Business Associate shall, within ten (10) business days of becoming aware of a disclosure of PHI in violation of this Agreement by Business Associate, its officers, directors, employees, contractors, Subcontractors or agents or by a third party to which Business Associate disclosed PHI, report to Covered Entity any such disclosure.

2.6. Reporting Breaches of Unsecured PHI. Business Associate shall, within ten (10) business days of becoming aware of a Breach of unsecured PHI, by Business Associate, its officers, directors, employees, contractors, Subcontractors or agents or by a third party to which Business Associate disclosed PHI, notify the Covered Entity of the Breach. Notice of any such Breach shall include the identification of any individual whose unsecured PHI has been, or is reasonably believed by Business Associate, to have been accessed, acquired or disclosed during such Breach and any other information required by the applicable HIPAA Rules.

2.7. Mitigation. Business Associate shall, to the extent practicable, mitigate any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of this Agreement.

2.8. Agents and Subcontractors. Business Associate shall ensure that any Subcontractor that create, receive, maintain or transmit PHI on behalf of the Business Associate agree in writing to the same restrictions, conditions and requirements that apply to Business Associate with respect to such PHI, including without limitation the provisions of this Section 2.

2.9. Designated Record Set. Business Associate hereby represents that it does not create, collect, compile or maintain Protected Health Information in any form in connection with the services provided pursuant to this Agreement, except that Business Associate may maintain an exact duplicate of the Protected Health Information maintained by the Covered Entity. If Business Associate maintains an exact duplicate of the Protected Health Information, Business Associate represents that Business Associate will not amend, supplement, delete any part of, revise or otherwise alter the Protected Health Information except as requested by the Covered Entity to the extent necessary to conform to the Designated Record Set maintained by the Covered Entity.

2.10. Third Party Requests. If Business Associate receives any request from a third party with respect to PHI, including, without limitation, a request for access, amendment or an accounting, Business Associate shall, within five (5) business days, forward such request to the Covered Entity. Following receipt of such notice, the Covered Entity shall be responsible for responding to such request. To assist the Covered Entity in handling such requests, Business Associate shall at all times make any and all PHI in its possession available to the Covered Entity within five (5) calendar days of request.

2.11. Audit. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by, Business Associate on behalf of the Covered Entity available to the Secretary of Health and Human Services or to the Covered Entity, upon request, for purposes of determining and facilitating compliance with HIPAA.

2.12. Accounting for Disclosures. Business Associate agrees to maintain and make available to the Covered Entity an accounting of disclosures of PHI as would be required for Covered Entity to respond to a request by an individual made in accordance with 45 CFR § 164.528. Business Associate shall provide an accounting of disclosures made during the six (6) years prior to the date on which the accounting is requested for PHI maintained in an electronic health record, beginning on the applicable effective date pursuant to the HITECH Act passed as part of ARRA. At a minimum, the accounting of disclosures shall include the following information:

(a) Date of disclosures,

(b) The name of the person or entity who received the PHI, and if known, the address of such entity or person,

(c) A brief description of the PHI disclosed, and

(d) A brief statement of the purpose of such disclosure which includes an explanation of the basis of such disclosure.

2.13. Remuneration in Exchange for PHI. Business Associate shall not directly or indirectly receive remuneration in exchange for any PHI without a valid authorization permitting such remuneration, except as permitted by law. Such valid authorization obtained from the individual who is the subject of the PHI must be obtained in accordance with 45 CFR § 164.508 and include specification of whether the PHI can be further exchanged for remuneration by the entity receiving the PHI of that individual, except as otherwise allowed under the HITECH Act.

2.14. Penalties for Noncompliance. Business Associate acknowledges that it is subject to civil and criminal enforcement for failure to comply with the HIPAA Rules.

2.15. Record Keeping. Business Associate agrees to implement an appropriate record keeping process to enable it to comply with the requirements of this Section 2.

2.16. Survival. The terms of Section 2 shall survive the termination or expiration of this Agreement.

3. Obligations of the Covered Entity. The Covered Entity agrees that it:

3.1. Has included, and will include, in its Notice of Privacy Practices a statement that the Covered Entity may disclose PHI for health care operations purposes.

3.2. Has obtained, and will obtain, from individuals such consents, authorizations and other permissions as are required by applicable laws (including without limitation, the HIPAA Rules).

3.3. Will promptly notify Business Associate in writing of any restrictions on the use and disclosure of PHI that the Covered Entity has agreed to that may affect Business Associate’s ability to provide Services or to perform its obligations under this Agreement.

3.4. Will promptly notify Business Associate in writing of any change in, or revocation of, permission to use or disclose PHI, if such change or revocation may affect Business Associate’s ability to provide services or to perform its obligations under this Agreement.

4. Term and Termination.

4.1. Term. This Agreement shall be effective as of the Effective Date and shall terminate automatically upon Business Associate’s completion of the engagement for the provision of services.

4.2. Right to Terminate for Cause. The Covered Entity may terminate this Agreement if it determines, in its sole discretion, that Business Associate has failed to comply with or breached any provision of this Agreement, and upon written notice to Business Associate of the breach, Business Associate fails to cure the breach within the number of days set forth in the written notice to Business Associate after receipt of notice. Any such termination will be effective immediately or at such other date specified in the Covered Entity’s notice of termination.

4.3. Termination for Change of Status. Business Associate may terminate this Agreement if facts, circumstances or law change in such a way as to cause Business Associate no longer to be a Business Associate of the Covered Entity. If Business Associate terminates this Agreement pursuant to this subsection, it shall give the Covered Entity notice of termination that includes the reasons why Business Associate is no longer a Business Associate.

4.4. Obligations of Business Associate Upon Termination. Upon termination of this Agreement for any reason, Business Associate with respect to protected health information received from Covered Entity, or created, maintained or received by Business Associate on behalf of Covered Entity shall:

(a) Retain only that PHI which is necessary for Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

(b) Return to Covered Entity, or if agreed to in writing by Covered Entity, destroy the remaining PHI that the Business Associate still maintains in any form;

(c) Continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information to prevent use or disclosure of the PHI, other than as provided for in this Section 4, for as long as the Business Associate retains the PHI;

(d) Not use or disclose the PHI retained by Business Associate other than for the purposes for which such Protected Health Information was retained and subject to the same conditions set out at Section 2.2 which applied prior to termination; and

(e) Return to Covered Entity or, if agreed to in writing by Covered Entity, destroy the PHI retained by Business Associate when it is no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.

4.5. Continuing Privacy and Security Obligation. Business Associate’s obligation to protect the privacy and safeguard the security of the Covered Entity’s PHI as specified in this Agreement will be continuous and survive termination or other conclusion of this Agreement.

5. Privacy Rule. Business Associate will develop, implement, maintain and use appropriate administrative, technical and physical safeguards to protect the privacy of Covered Entity’s PHI. The safeguards must reasonably protect Covered Entity’s PHI from any intentional or unintentional use or disclosure in violation of the Privacy Rule and limit incidental uses or disclosures made pursuant to a use or disclosure otherwise permitted by this Agreement.

6. Security Rule. Business Associate shall:

6.1. Implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic Protected Health Information which are, at a minimum, substantially similar to those administrative, physical and technical safeguards employed by the Covered Entity;

6.2. Ensure that any agent, including a Subcontractor, to whom Business Associate provides Electronic Protected Health Information agrees to implement reasonable and appropriate safeguards to protect Electronic Protected Health Information; and

6.3. Report to the Covered Entity any Security Incident of which Business Associate becomes aware.

7. Breaches and Security Incidents.

7.1. Breaches. Business Associate will report to Covered Entity any use or disclosure of Covered Entity’s PHI not permitted by this Agreement along with any Breach of Covered Entity’s Unsecured PHI. Business Associate will treat the Breach as being discovered in accordance with 45 CFR 164.410. Business Associate will make the report to Covered Entity’s Privacy Official not more than 30 calendar days after Business Associate learns of such non-permitted use or disclosure. If a delay is requested by a law-enforcement official in accordance with 45 CFR 164.412, Business Associate may delay notifying Covered Entity for the applicable time period. Business Associate’s report will at least:

(a) Identify the nature of the Breach or other non-permitted use or disclosure, which will include a brief description of what happened, including the date of any Breach and the date of the discovery of any Breach;

(b) Identify the Covered Entity’s PHI that was subject to the non-permitted use or disclosure or Breach (such as whether full name or account number or social security number were involved) on an individual basis;

(c) Identify who made the non-permitted use or disclosure and who received the non-permitted disclosure;

(d) Identify what corrective or investigational action Business Associate took or will take to prevent further non-permitted uses or disclosures, to mitigate harmful effects and to protect against any further Breaches;

(e) Identify what steps the individuals who were subject to a Breach should take to protect themselves; and

(f) Provide such other information, including a written report, as Covered Entity may reasonably request.

7.2. Security Incidents. Business Associate will report to Covered Entity any attempted or successful (a) unauthorized access, use, disclosure, modification or destruction of Covered Entity’s Electronic PHI or (b) interference with Business Associate’s system operations in Business Associate’s information systems, of which Business Associate becomes aware. Business Associate will make this report periodically, as requested by Covered Entity, except if such incident resulted in a disclosure not permitted by this Agreement or Breach of Covered Entity’s Unsecured Protected PHI, Business Associate will make the report in accordance with the provisions set forth in the paragraph above.

8. Required Disclosure. If Business Associate is confronted with legal action to disclose any portion of PHI, Business Associate shall promptly notify and assist the Covered Entity (at the Covered Entity’s expense) in obtaining a protective order or other similar order, and shall thereafter disclose only the minimum amount of PHI that is required to be disclosed in order to comply with the legal action, whether or not a protective order or other order has been obtained.

9. Injunctive Relief. Business Associate acknowledges that its use or disclosure of any of PHI without the Covered Entity’s prior written consent would cause continuing, substantial and irreparable injury to the Covered Entity and that the Covered Entity’s remedies at law for such disclosure will not be adequate. Accordingly, Business Associate agrees that the Covered Entity shall be entitled to immediate injunctive relief against the breach or threatened breach of the foregoing undertakings by Business Associate, and that such rights shall be in addition to, and not a limitation of, any other rights or remedies to which the Covered Entity may be entitled at law or equity.

10. Indemnification. Business Associate shall indemnify and hold harmless the Covered Entity, and all of its directors, officers, members, employees and agents, against any and all claims, demands, losses, costs, expenses, obligations, liabilities, actions, suits, damages and deficiencies (including, without limitation, all costs and reasonable attorneys’ fees) that arise out of or are proximately caused by any use or disclosure of PHI by Business Associate, its employees, agents, Subcontractors, or independent contractors that is not permitted under this Agreement. Business Associate shall provide prompt written notice of, and information and assistance (at Business Associate’s expense), as reasonably requested, in the defense of such claim, suit or proceeding.

11. Amendment. The parties shall amend this Agreement from time to time by mutual written agreement in order to keep this Agreement consistent with any changes made to the HIPAA laws or regulations in effect as of the date of this Agreement and with any new regulations promulgated under HIPAA. Either party may terminate the Agreement in whole or in part if the parties are unable to agree to such changes by the compliance date for such new or revised HIPAA laws or regulations.

12. No Third Party Benefit. This Agreement is for the sole benefit of the parties hereto and shall not confer or be deemed to confer any rights, benefits or claims upon any person or entity not a party to this Agreement.

13. Entire Agreement. This Agreement, including any appendices, schedules or other exhibits now or subsequently attached hereto, constitutes the entire agreement between the parties with respect to the subject matter hereof.

14. Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning that permits the parties to comply with the HIPAA Rules.

15. Counterparts. This Agreement may be executed in two or more counterparts, each of which shall be an original, but all of which taken together shall constitute one and the same agreement.

IN WITNESS WHEREOF, the parties have executed this Agreement as of the Effective Date.

County of Marathon City of Wausau

City-County IT Commission North Central Health Care By:

___________________________________ (name) ___________________________________ (title)

Date

[NAME OF BUSINESS ASSOCIATE]

By:

Its:

Date

{00058247.DOC}