SAMPLE Attachment H-3 - HIPAA Qualified Service Organization Agreement.pdf

SAMPLE

3/13/2024 CAO/C.Hahn

Attachment H-3 Qualified Service Organization Agreement Page 1 of 3

ATTACHMENT H-3

Qualified Service Organization Agreement

Insert Department Name

Multnomah County ____________________ (“County”) and Contractor (“Qualified Service Organization”) have entered into one or more agreements (“Services Agreement”) pursuant to which Qualified Service Organization (“QSO”) is providing services to a County Part 2 Program that requires the QSO to receive, store, process or otherwise deal with Part 2 Data protected by 42 CFR Part 2. This agreement (“Agreement”) sets forth the terms and conditions pursuant to which the information will be handled between County and QSO during the term of each Services Agreement and after its termination.

ARTICLE 1. Terms

1.1 Terms used, but otherwise not defined, in this Agreement shall have the same meaning as those terms in 42 CFR Part 2 and as amended.

1.2 Individual. “Individual” shall mean an individual who has applied for or been given diagnosis or treatment for substance use disorder at a County Part 2 Program and includes any individual who, after arrest on a criminal charge, is identified as an individual with a substance use disorder in order to determine that individual's eligibility to participate in a substance use disorder program at County.

1.3 Part 2 Data shall mean any information relating to an Individual created by, received, or acquired by a County Part 2 Program that is protected under 42 CFR Part 2.

ARTICLE 2. Obligations and Activities of Qualified Service Organization

QSO shall:

2.1 Not store, process, use, or disclose Part 2 Data other than as permitted or required by this Agreement or as permitted or required by law. QSO shall store, process, use, or disclose the minimum necessary Part 2 Data to fulfill its obligations to County or as otherwise imposed by law.

2.2 Implement and use appropriate administrative, technical and physical safeguards with respect to Part 2 Data, to prevent use or disclosure of the Part 2 Data other than as provided for by this Agreement.

2.3 Mitigate, to the extent practicable and without unreasonable delay, any harmful effect that is known or suspected to QSO of a use or disclosure of Part 2 Data by QSO in violation of this Agreement or 42 CFR Part 2.

2.4 Not re-disclose any Part 2 Data, except as otherwise permitted by 42 CFR Part 2.

2.5 Be fully bound by the provisions of the federal regulations governing Confidentiality of Substance Use Disorder Patient Records, 42 CFR Part 2 when receiving, storing, processing, or otherwise dealing with Part 2 Data.

2.6 Resist any effort in a judicial proceeding to obtain access to Part 2 Data or other information pertaining to Individuals except as expressly provided for in 42 CFR Part 2. QSO shall immediately notify County if QSO receives such request.

ARTICLE 3. Permitted Uses and Disclosures by Qualified Service Organization

3.1 QSO is authorized to receive, store, process, use or disclose Part 2 Data for the express purpose(s) described in the underlying Services Agreement, provided that nothing in this Agreement authorizes QSO to process, store, use or disclose Part 2 Data in violation of 42 CFR Part 2 or any more stringent state law provisions.

3.2 Within five (5) days of discovery, QSO must notify County in writing of any known or suspected use or disclosure of Part 2 Data in violation of or not provided for by this Agreement. Notification must include:

Attachment H-3 Qualified Service Organization Agreement Page 2 of 3

3.2.1 the individuals whose Part 2 Data has been, or is reasonably believed to have been, the subject of the unpermitted use or disclosure,

3.2.2 the type of Part 2 Data used or disclosed,

3.2.3 the date of the unpermitted use or disclosure,

3.2.4 the date of discovery, and

3.2.5 a description of what QSO is doing to investigate the unpermitted use or disclosure of Part 2 Data, to mitigate loss, and to protect against any further or future unpermitted uses or disclosures of Part 2 Data.

ARTICLE 4. Term and Termination

4.1 Term. This Agreement shall be effective upon execution, and shall terminate when the Services Agreement terminates or on the date either party terminates for cause as authorized in Section 4.2 of this Agreement.

4.2 Termination for Cause. Upon the QSO’s or County’s knowledge of a material breach by the other party, the

County or QSO may either:

4.2.1 Provide an opportunity for the breaching party to cure the breach or end the violation and terminate this Agreement and the Services Agreement(s) if the breaching party does not cure the breach or end the violation within five (5) business days. The breaching party shall notify, in writing, the actions taken to cure the breach or end the violation; or

4.2.2 Immediately terminate this Agreement and the Services Agreement(s) if the breaching party has breached a material term of this Agreement and cure is not feasible.

4.3 Effect of Termination

4.3.1 Except as provided in this section, upon termination of this Agreement, for any reason, QSO shall return or destroy all Part 2 Data received from County. This provision shall apply to Part 2 Data that is in the possession of subcontractors or agents of QSO. QSO shall retain no copies of the Part 2 Data.

4.3.2 In the event that QSO determines that returning or destroying the Part 2 Data is infeasible, and County agrees, QSO shall extend the protections of this Agreement to such Part 2 Data and limit further uses and disclosures of such Part 2 Data to those purposes that make the return or destruction infeasible, for so long as QSO maintains such Part 2 Data.

ARTICLE 5. Miscellaneous

5.1 Amendment. County and QSO shall take such action as is necessary to amend this Agreement from time to time as is necessary for County to comply with the requirements of 42 CFR Part 2.

5.2 Survival. The respective rights and obligations of QSO under Section 4.3 of this Agreement shall survive the termination of this Agreement.

5.3 Interpretation. Any ambiguity in this Agreement shall be resolved to permit County to comply with 42 CFR

Part 2.

5.4 Other Laws. Nothing herein shall be construed as authorizing either party to fail to comply with any other applicable law relating to health care records.

5.5 Remedies in Event of Breach. QSO recognizes that irreparable harm will result to County, and to County business, in the event of breach by QSO of any of the covenants and assurances contained in this Agreement. As such, in the event of breach of any of the covenants and assurances contained herein, County will be entitled to enjoin and restrain QSO from any continued violation of this Agreement.

Furthermore, in the event of breach of this Agreement by QSO, County is entitled to reimbursement and

Attachment H-3 Qualified Service Organization Agreement Page 3 of 3 indemnification from QSO for County's reasonable attorneys’ fees and expenses and costs, including notices the County is required to give as a result of any unpermitted use or disclosure of Part 2 Data, that were reasonably incurred as a result of QSO's breach. The remedies contained in this Article are in addition to (and do not supersede) any action for damages and/or any other remedy County may have for breach of any part of this Agreement. This provision shall survive termination of the Agreement.