SAMPLE BAA.doc

HIPAA BUSINESS ASSOCIATE AGREEMENT

The parties to this Business Associate Agreement (“Agreement”) are the Michigan Department of Health and Human Services and ___________.

RECITALS

A.

Under this Agreement, the Business Associate will collect or receive certain information on the Covered Entity’s behalf, some of which may constitute Protected Health Information (“PHI”). In consideration of the receipt of PHI, the Business Associate agrees to protect the privacy and security of the information as set forth in this Agreement.

B.

Covered Entity and the Business Associate intend to protect the privacy and provide for the security of PHI collected or received by the Business Associate under the Agreement in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”) and the HIPAA Rules, as amended.

C.

The HIPAA Rules require the Covered Entity to enter into an agreement containing specific requirements with the Business Associate before the Business Associate’s receipt of PHI.

AGREEMENT

1.

Definitions.

a.

The following terms used in this Agreement have the same meaning as those terms in the HIPAA Rules: Breach; Data Aggregation; Designated Record Set; Disclosure; Health Care Obligations; Individual; Minimum Necessary; Notice of Privacy Practices; Protected Health Information; Required by Law; Secretary; Security Incident; Security Measures, Subcontractor; Unsecured Protected Health Information, and Use.

b.

“Business Associate” has the same meaning as the term “business associate” at 45 CFR 160.103 and regarding this Agreement means [ ].

c.

“Covered Entity” has the same meaning as the term “covered entity” at 45 CFR 160.103 and regarding this Agreement means the Michigan Department of Health and Human Services.

d.

“HIPAA Rules” means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Part 160 and Part 164.

2.

Obligations of Business Associate.

Business Associate agrees to:

a.

use and disclose PHI only as permitted or required by this Agreement or as required by law.

b.

implement and use appropriate safeguards, and comply with Subpart C of 45 CFR 164 regarding electronic protected health information, to prevent use or disclosure of PHI other than as provided in this Agreement. Business Associate must maintain, and provide a copy to the Covered Entity within 10 days of a request from the Covered Entity, a comprehensive written information privacy and security program that includes security measures that reasonably and appropriately protect the confidentiality, integrity, and availability of PHI relative to the size and complexity of the Business Associate’s operations and the nature and the scope of its activities.

c.

report to the Covered Entity within 24 hours of any use or disclosure of PHI not provided for by the Agreement of which it becomes aware, including breaches of Unsecured Protected Health Information as required by 45 CFR 164.410, and any Security Incident of which it becomes aware. If the Business Associate is responsible for any unauthorized use or disclosure of PHI, it must promptly act as required by applicable federal and State laws and regulations. Covered Entity and the Business Associate will cooperate in investigating whether a breach has occurred, to decide how to provide breach notifications to individuals, the federal Health and Human Services’ Office for Civil Rights, and potentially the media.

d.

ensure, according to 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), if applicable, that any subcontractors that create, receive, maintain, or transmit PHI on behalf of the Business Associate agree to the same restrictions, conditions, and requirements that apply to the Business Associate regarding such information. Each subcontractor must sign an agreement with the Business Associate containing substantially the same provisions as this Agreement and further identifying the Covered Entity as a third party beneficiary of the agreement with the subcontractor. Business Associate must implement and maintain sanctions against subcontractors that violate such restrictions and conditions and must mitigate the effects of any such violation.

e.

make available PHI in a Designated Record Set to the Covered Entity within 10 days of a request from the Covered Entity to satisfy the Covered Entity’s obligations under 45 CFR 164.524.

f.

within ten days of a request from the Covered Entity, amend PHI in a Designated Record Set under, 45 CFR § 164.526. If any individual requests an amendment of PHI directly from the Business Associate or its agents or subcontractors, the Business Associate must notify the Covered Entity in writing within five days of the request and amend the information within ten days of the request. Any denial of amendment of PHI maintained by the Business Associate or its agents or subcontractors is the responsibility of the Business Associate.

g.

maintain, and within ten days of a request from the Covered Entity make available, the information required to provide an accounting of disclosures to enable the Covered Entity to fulfill its obligations under 45 CFR § 164.528. Business Associate is not required to provide an accounting to the Covered Entity of disclosures: (i) to carry out treatment, payment or health care operations, as set forth in 45 CFR § 164.506; (ii) to individuals of PHI about them as set forth in 45 CFR § 164.502; (iii) under an authorization as provided in 45 CFR § 164.508; (iv) to persons involved in the individual’s care or other notification purposes as set forth in 45 CFR § 164.510; (v) for national security or intelligence purposes as set forth in 45 CFR § 164.512(k)(2); (vi) to correctional institutions or law enforcement officials as set forth in 45 CFR § 164.512(k)(5); (vii) as part of a limited data set according to 45 CFR 164.514(e); or (viii) that occurred before the compliance date for the Covered Entity. Business Associate agrees to implement a process that allows for an accounting to be collected and maintained by the Business Associate and its agents or subcontractors for at least six years before the request, but not before the compliance date of the Privacy Rule. At a minimum, such information must include: (i) the date of disclosure; (ii) the name of the entity or person who received PHI and, if known, the address of the entity or person; (iii) a brief description of PHI disclosed; and (iv) a brief statement of purpose of the disclosure that reasonably informs the individual of the basis for the disclosure or a copy of the written request for disclosure. If the request for an accounting is delivered directly to the Business Associate or its agents or subcontractors, the Business Associate must, within ten days of the receipt of the request, forward it to the Covered Entity in writing.

h.

to the extent the Business Associate is to carry out one or more of the Covered Entity’s obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to the Covered Entity when performing those obligations.

i.

make its internal practices, books, and records relating to the Business Associate’s use and disclosure of PHI available to the Secretary for purposes of determining compliance with the HIPAA Rules. Business Associate must concurrently provide to the Covered Entity a copy of any PHI that the Business Associate provides to the Secretary.

j.

retain all PHI throughout the term of the Agreement and for a period of six years from the date of creation or the date when it last was in effect, whichever is later, or as required by law. This obligation survives the termination of the Agreement.

k.

implement policies and procedures for the final disposition of PHI and the hardware and equipment on which it is stored, including but not limited to, removal of PHI before re-use.

l.

within ten days of a written request by the Covered Entity, the Business Associate and its agents or subcontractors must allow the Covered Entity to conduct a reasonable inspection of the facilities, systems, books, records, agreements, policies and procedures relating to the use or disclosure of PHI under this Agreement. Business Associate and the Covered Entity will mutually agree in advance upon the scope, timing and location of such an inspection. Covered Entity must protect the confidentiality of all confidential and proprietary information of the Business Associate to which the Covered Entity has access during the course of such inspection. Covered Entity and the Business Associate will execute a nondisclosure agreement, if requested by the other party. The fact that the Covered Entity inspects, or fails to inspect, or has the right to inspect, the Business Associate’s facilities, systems, books, records, agreements, policies and procedures does not relieve the Business Associate of its responsibility to comply with this Agreement. Covered Entity’s (i) failure to detect or (ii) detection, but failure to notify Associate or require Associate’s remediation of any unsatisfactory practices, does not constitute acceptance of such practice or a waiver of the Covered Entity’s enforcement rights under this Agreement.

3.

Permitted Uses and Disclosures by the Business Associate.

a.

Business Associate may use or disclose PHI:

(1) for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate; provided, however, either (A) the disclosures are required by law, or (B) the Business Associate obtains reasonable assurances from the person to whom the information is disclosed that the information will remain confidential and used or further disclosed only as required by law or for the purposes for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached;

(2) as required by law;

(3) for Data Aggregation services relating to the health care operations of the Covered Entity;

(4) to de-identify, consistent with 45 CFR 164.514(a) – (c), PHI it receives from the Covered Entity. If the Business Associates de-identifies the PHI it receives from the Covered Entity, the Business Associate may use the de-identified information for any purpose not prohibited by the HIPAA Rules; and

(5) for any other purpose listed here: [care coordination with Michigan Community Mental Health Service Programs and Prepaid Inpatient Health Plans].

b.

Business Associate agrees to make uses and disclosures and requests for PHI consistent with the Covered Entity’s minimum necessary policies and procedures.

c.

Business Associate may not use or disclose PHI in a manner that would violate Subpart E of 45 CFR Part 164 if done by the Covered Entity except for the specific uses and disclosures described above in 3(a)(i) and (iii).

4.

Covered Entity’s Obligations Covered entity agrees to:

a. use its Security Measures to reasonably and appropriately maintain and ensure the confidentiality, integrity, and availability of PHI transmitted to the Business Associate under this Agreement until the PHI is received by the Business Associate.

b. provide the Business Associate with a copy of its Notice of Privacy Practices and must notify the Business Associate of any limitations in the Notice of Privacy Practices of the Covered Entity under 45 CFR 164.520 to the extent that such limitation may affect the Business Associate’s use or disclosure of PHI.

c. notify the Business Associate of any changes in, or revocation of, the permission by an individual to use or disclose the individual’s PHI to the extent that such changes may affect the Business Associate’s use or disclosure of PHI.

d. notify the Business Associate of any restriction on the use or disclosure of PHI that the Covered Entity has agreed to or is required to abide by under 45 CFR 164.522 to the extent that such restriction may affect the Business Associate’s use or disclosure of PHI.

5.

Term. This Agreement continues in effect until terminated or is replaced with a new agreement between the parties containing provisions meeting the requirements of the HIPAA Rules, whichever first occurs.

6.

Termination.

a.

Material Breach. In addition to any other provisions in the Agreement regarding breach, a breach by the Business Associate of any provision of this Agreement, as determined by the Covered Entity, constitutes a material breach of the Agreement and provides grounds for the Covered Entity to terminate this Agreement for cause. Termination for cause is subject to 6.b.:

(1) Default. If the Business Associate refuses or fails to timely perform any of the provisions of this Agreement, the Covered Entity may notify the Business Associate in writing of the non-performance, and if not corrected within thirty days, the Covered Entity may immediately terminate the Agreement. The Business Associate must continue performance of the Agreement to the extent it is not terminated.

(2) Business Associate’s Duties. Notwithstanding termination of the Agreement, and subject to any directions from the Covered Entity, the Business Associate must protect and preserve property in the possession of the Business Associate in which the Covered Entity has an interest.

(3) Erroneous Termination for Default. If the Covered Entity terminates this Agreement under Section 6(a) and after such termination it is determined, for any reason, that the Business Associate was not in default, then such termination will be treated as a termination for convenience, and the rights and obligations of the parties will be the same as if the Agreement had been terminated for convenience.

b.

Reasonable Steps to Cure Breach. If the Covered Entity knows of a pattern of activity or practice of the Business Associate that constitutes a material breach or violation of the Business Associate’s obligations under the provisions of this Agreement or another arrangement and does not terminate this Agreement under Section 6(a), then the Covered Entity must notify the Business Associate of the pattern of activity or practice. The Business Associate must then take reasonable steps to cure such breach or end such violation, as applicable. If the Business Associate’s efforts to cure such breach or end such violation are unsuccessful, the Covered Entity may either (i) terminate this Agreement, if feasible or (ii) report the Business Associate’s breach or violation to the Secretary.

c.

Effect of Termination. After termination of this Agreement for any reason, the Business Associate, with respect to PHI it received from the Covered Entity, or created, maintained, or received by the Business Associate on behalf of the Covered Entity, must:

(1) retain only that PHI which is necessary for the Business Associate to continue its proper management and administration or to carry out its legal responsibilities;

(2) return to the Covered Entity (or, if agreed to by the Covered Entity in writing, destroy) the remaining PHI that the Business Associate still maintains in any form;

(3) continue to use appropriate safeguards and comply with Subpart C of 45 CFR Part 164 with respect to electronic protected health information to prevent use or disclosure of the PHI, other than as provided for in this Section, for as long as the Business Associate retains the PHI;

(4) not use or disclose the PHI retained by the Business Associate other than for the purposes for which such PHI was retained and subject to the same conditions set out at Section 3(a)(1) which applied before termination; and

(5) return to the Covered Entity (or, if agreed to by the Covered Entity in writing, destroy) the PHI retained by the Business Associate when it is no longer needed by the Business Associate for its proper management and administration or to carry out its legal responsibilities.

7.

No Waiver of Immunity. The parties do not intend to waive any of the immunities, rights, benefits, protection, or other provisions of the Michigan Governmental Immunity Act, MCL 691.1401, et seq., the Federal Tort Claims Act, 28 U.S.C. 2671 et seq., or the common law.

8.

Data Ownership. The Business Associate has no ownership rights in the PHI. The covered entity retains all ownership rights of the PHI.

9.

Disclaimer. The Covered Entity makes no warranty or representation that compliance by the Business Associate with this Agreement, HIPAA, or the HIPAA Rules will be adequate or satisfactory for the Business Associate’s own purposes. The Business Associate is solely responsible for all decisions made by the Business Associate regarding the safeguarding of PHI.

10.

Certification. If the Covered Entity determines an examination is necessary to comply with the Covered Entity’s legal obligations under HIPAA relating to certification of its security practices, the Covered Entity or its authorized agents or contractors, may, at the Covered Entity’s expense, examine the Business Associate’s facilities, systems, procedures and records as may be necessary for such agents or contractors to certify to the Covered Entity the extent to which the Business Associate’s security safeguards comply with HIPAA, the HIPAA Rules or this Agreement.

11.

Amendment. The parties acknowledge that state and federal laws relating to data security and privacy are rapidly evolving and that amendment of this Agreement may be required to provide for procedures to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement the standards and requirements of HIPAA and the HIPAA Rules. Upon the request of either party, the other party agrees to promptly enter into negotiations concerning the terms of an amendment to this Agreement embodying written assurances consistent with the standards and requirements of HIPAA and the HIPAA Rules. Either party may terminate the Agreement upon thirty days written notice if (i) one party does not promptly enter into negotiations to amend this Agreement when requested by the other party or (ii) the Business Associate does not enter into an amendment to this Agreement providing assurances regarding the safeguarding of PHI that the Covered Entity, in its sole discretion, deems sufficient to satisfy the standards and requirements of HIPAA or the HIPAA Rules.

12.

Assistance in Litigation or Administrative Proceedings. Business Associate must make itself, and any subcontractors, employees or agents assisting the Business Associate in the performance of its obligations under this Agreement, available to the Covered Entity, at no cost to the Covered Entity, to testify as witnesses, or otherwise, if litigation or administrative proceedings are commenced against the Coverd Entity, its directors, officers or employees, departments, agencies, or divisions based upon a claimed violation of HIPAA or the HIPAA Rules or other laws relating to the Business Associate’s or its subcontractors use or disclosure of PHI under this Agreement, except where the Business Associate or its subcontractor, employee or agent is a named adverse party.

13.

No Third Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer upon any person other than the Covered Entity, the Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

14.

Interpretation and Order of Precedence. Any ambiguity in this Agreement must be interpreted to permit compliance with the HIPAA Rules. Where the provisions of this Agreement differ from those mandated by the HIPAA Rules, but are nonetheless permitted by the HIPAA Rules, the provisions of this Agreement control.

15.

Effective Date. This Agreement is effective upon receipt of the last approval necessary and the affixing of the last signature required.

16.

Survival of Certain Agreement Terms. Notwithstanding any contrary provision in this Agreement, the Business Associate’s obligations under Section 6(d) and record retention laws (“Effect of Termination”) and Section 12 (“No Third Party Beneficiaries”) survive termination of this Agreement and are enforceable by the Covered Entity.

17.

Representatives and Notice.

a.

Representatives. The individuals listed below are designated as the parties’ respective representatives for purposes of this Agreement. Either party may from time to time designate in writing new or substitute representatives.

b.

Notices. All required notices must be in writing and must be hand delivered or given by certified or registered mail to the representatives at the addresses set forth below.

Covered Entity Representative:

James Bowen Privacy and Security Manager MDHHS Compliance Office

333 South Grand Ave, 4th Floor Lansing, MI 48933

(517) 284-1018

MDHHSPrivacySecurity@michigan.gov Business Associate Representative:

Name:

Title:

Department:

Address:

Phone:

Email:

Name:

Title:

Department:

Address:

Phone:

Email:

Any notice given to a party under this Agreement shall be deemed effective, if addressed to such party, upon: (i) delivery, if hand delivered; or (ii) the third Business Day after being sent by certified or registered mail.

[INSERT NAME]

By:_______________________________

Date:______________________________

[INSERT NAME]

Date: _____________________________

Print Name:________________________

Print Name:_________________________

Title:_____________________________

Title:______________________________

Covered Entity

[INSERT NAME]

Date: _____________________________

Print Name:

Title:_____________________________