Attachment_1_-_HIPPA_Statement.docx

ATTACHMENT I

HIPPA REGULATIONS

BY SIGNING THIS CONTRACT, THE CONTRACTOR AGREES TO THE FOLLOWING:

CONTRACTOR/VENDOR DISCLOSURE AGREEMENT

The Armed Forces Retirement Home (AFRH-G) has a legal and ethical responsibility to safeguard the privacy of all patients and to protect the confidentiality of their health information. In the course of its business relationship with the AFRH-G, the Contractor and/or its employees and/or agents may come into possession of confidential patient information, even though they may not be directly involved in providing patient services.

In consideration of, and as a condition to, its business relationship with the AFRH-G and its employees and/or agents will hold the following information in strictest confidence:

1 Any information supplied by AFRH-G or its affiliates

2 Any information, which is the direct or indirect result of services, provided for the AFRH-G under this contract

3 Any information about AFRH-G or its affiliates’ business operations, products, services, or residents;

OR

BUSINESS ASSOCIATE AGREEMENT

Whereas, the Contractor shall provide a service to the AFRH-G and, in connection with provision of these services, the AFRH-G may disclose to the Contractor Protected Health Information (PHI) that is subject to protection under the regulations issued by the Department of Health and Human Services, as mandated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA); 45 CFR Parts 160 and 164, Subpart A and H, the Standards for Privacy of Individually Identifiable Health Information (“Privacy Rule”); and 45 CFR Parts 160 and 164, Subpart A and C, the Security Standard (“Security Rule”); and

Whereas, the AFRH-G is a “Covered Entity” as that term is defined in the HIPAA implementing regulations, 45CFR 160.103, and

Whereas I, the contractor, as a recipient of PHI from “Covered Entity”, is a “Business Associate” of the “Covered Entity” as the term “Business Associate” is defined in the HIPAA implementing regulations, 45 CFR160.103; and

Whereas, pursuant to the Privacy and Security Rules, all Business Associates of Covered Entities must agree in writing to certain mandatory provisions regarding the use and disclosure of PHI and

Whereas, the purpose of this Agreement is to comply with the requirements of the Privacy and Security rules, including, but not limited to the Business Associate contract requirements at 45 CFR “164.308(b), 164.314(a), 164.502(e) and 154.504(c) and as may be amended.

1 Definitions: Unless otherwise provided in this Agreement, capitalized terms have the same meanings as set forth in the Privacy and Security Rules. The term “Protected Health Information” or the abbreviation “PHI” shall include the term “Electronic Protected Health Information” and the abbreviation “EPHI” in this agreement.

2 Ownership of PHI. PHI provided to the Contractor or created, gathered or received by the Contractor, its agents and subcontractors under this agreement is the property of AFRH-G.

3 Scope of Use and Disclosure by Business Associate of Protected Health Information and Electronic Protected Health Information.

a) Business Associate shall be permitted to make Use and Disclosure of PHI that is disclosed to it by Covered Entity, or created, gathered or received by Business Associate on behalf of Covered Entity, as necessary to perform its obligation under this Agreement provided the AFRH-G may make such Use or Disclosure under the Privacy and Security Rules, and the Use or Disclosure complies with the Covered Entity’s minimum necessary policies and procedures.

b) Unless otherwise limited herein, in addition to any other Uses and/or Disclosures permitted or authorized by this Agreement or required by law a Business Associate may:

(1) Use the PHI in its possession for its proper management and administration and to fulfill any legal responsibilities of Business Associate

(2) Make a Disclosure of the PHI in its possession to a third party for the purpose of Business Associate’s proper management and administration or to fulfill any legal responsibilities of Business Associate; provided, however, that the disclosures are Required By Law or permitted by Federal law and AFRH-G policy and Business Associate has received from the third party written assurances that (a) the information will be held confidentially and Use or further Disclosure made only as Required by Law or for the purposes for which it was disclosed to the third part; and (b) the third party will notify the Business Associate of any instances of which it becomes aware in which the confidentiality of the information has been breached;

(3) Engage in Data Aggregation activities, consistent with the Privacy Rule; and

(4) De-identify any and all PHI created or received by Business Associate under this Agreement; provided, that the de-identification conforms to the requirements of the Privacy Rule.

4 Obligations of Business Associate: In connection with its Use and Disclosure of PHI received from Covered Entity or created, gathered or received on behalf of Covered Entity, Business Associate agrees that it will:

a) Use or make further Disclosure of PHI only as permitted or required by this Agreement or as Required By Law;

b) Use reasonable and appropriate safeguards to prevent Use or Disclosure of PHI other than as provided for by this Agreement;

c) To the extent practicable, mitigate any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of this Agreement;

d) Promptly report to Covered Entity any Security Incident, or Use or Disclosure of PHI not provided for by this Agreement, of which Business Associate becomes aware;

e) Require contractor, subcontractors or agents to whom Business Associate provides PHI to agree to the same restrictions and conditions that apply to Business Associate pursuant to this Agreement, including implementation of reasonable and appropriate safeguards to protect PHI;

f) Make available to the Secretary of Health and Human Services Business Associate’s internal practices, books and records, including policies and procedures, relating to the Use or Disclosure of PHI for purposes of determining Covered Entity’s compliance with the Privacy and Security Rules, subject to any applicable legal privileges;

g) If the Business Associate maintains PHI in a Designated Record Set, maintain the information necessary to document this disclosure of PHI sufficient to make an accounting of those disclosures as required under the Privacy Rule and the Privacy Act, 5 USC 552a, and within 15 days of receiving a request from Covered Entity, make available the information necessary for Covered Entity to make an accounting of Disclosures of PHI about an individual in the Designated Record Set or Covered Entity’s Privacy Act System of Records;

h) If the Business Associate maintains PHI in a Designated Record Set or Privacy Act System of Records, within 10 days of receiving a written request from Covered Entity, make available PHI in the Designated Record Set or System of Records necessary for Covered Entity to respond to individuals; requests for access to PHI about them that is not in the possession of Covered Entity.

5 Obligation of Covered Entity: Covered Entity agrees that it:

a) Has obtained, and will obtain, from Individuals any consents, authorizations and other permissions necessary or required by laws applicable to Covered Entity for Business Associate and Covered Entity to fulfill their obligations under this Agreement.

b) Will promptly notify Business Associate in writing of any restriction on the Use and Disclosure of PHI about individuals that Covered Entity has agreed to that may affect Business Associate’s ability to perform its obligations under this Agreement;

c) Will promptly notify Business Associate in writing of any changes in, or revocation of, permission by an individual to use or disclose PHI, in such changes or revocation may affect Business Associate’s ability to perform its obligation under this Agreement.

6 Termination:

a) Termination for Cause: Upon Covered Entity’s knowledge of a material breach by Business Associate, Covered Entity shall either:

(1) Provide an opportunity for Business Associate to cure the breach or end the violation and terminate this Agreement if Business Associate does not cure the breach or end the violation within the time specified by Covered Entity;

(2) Immediately terminate this Agreement if Business Associate has breached a material term of this Agreement and cure is not possible;

(3) If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary of Health and Human Services.

b) Automatic Termination: This Agreement will automatically terminate upon completion of the Business Associate’s duties under the underlying agreement, or termination of that agreement by either party.

c) Effect of Termination:

(1) Termination of this Agreement will result in cessation of activities by the Business Associate and any agents or subcontractors of its involving PHI under this Agreement.

(2) Upon termination of this Agreement, Business Associate will return or destroy all PHI received from Covered Entity or created, gathered or received by Business Associate and its agents and subcontractors on behalf of Covered Entity under this Agreement. The Business Associate shall certify that all PHI has been returned to Covered Entity or destroyed. If immediate return or destruction of all PHI is not possible, the contractor further certifies that any data retained will be safeguarded to prevent unauthorized Uses or Disclosures.

7 Amendment: Business Associate and Covered Entity agree to take such action as is necessary to amend this Agreement for Covered Entity to comply with the Requirements of the Privacy and Security Rules or other applicable laws.

8 Survival: The obligations of Business Associate under Section 6.C(2) of this Agreement shall survive any termination of this Agreement.

9 No Third Party Beneficiaries: Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever.

10 Other Applicable Law: This Agreement does not, and is not intended to, abrogate any responsibilities of the parties under any other applicable law.

11 In the event terms and conditions differ, the terms and conditions of the contract shall take precedence.

Effective Date: This Agreement shall be effective on the date of contract award.