ATTACHMENT_10 HIPPA-QC_Associate_Agreement.docx

Health Insurance Portability and Accountability Act (HIPAA) Business Associate Agreement for ARNG Recruit Sustainment Program (RSP) Quality Control (QC) Contract

Upon award of this contract, the Contractor agrees to perform the RSP Quality Assurance Services contract, according to the HIPAA requirements.

The Business Associate/RSP Contract Personnel:

1. Will use the protected health information exclusively to ensure medical records are compliant for RSP-QC Shipper Packets defined within the performance work statement of this contract. No other use of the Personalized Health Information (PHI) is authorized. Disclosure of PHI beyond the acceptable uses defined in this contract are subject to penalties prescribed in HIPAA.

2. Implement appropriate safeguards to prevent unauthorized use or disclosure of the information, including implementing requirements of the HIPAA Security Rule with regard to electronic protected health information.

3. Report to the covered entity any use or disclosure of the information not provided for by its contract, including incidents that constitute breaches of unsecured protected health information.

4. Disclose protected health information as specified in its contract to satisfy the covered entity’s obligation with respect to individuals' requests for copies of their protected health information, as well as make available protected health information for amendments (and incorporate any amendments, if required) and accountings.

5. Comply with the requirements applicable to the obligations under this contract to the extent the business associate is to carry out a covered entity’s obligation under the Privacy Rule.

6. Make available to the covered entity, upon request, its internal practices, books, and records relating to the use and disclosure of protected health information received from, or created or received by the business associate on behalf of, the covered entity for purposes of determining the covered entity’s and business associate’s compliance with the HIPAA Privacy Rule.

7. Return, or destroy if determined by the Government, all protected health information received from, or created or received by the business associate on behalf of, the Government at termination of the contract.

8. Ensure that any subcontractors it may engage on its behalf that will have access to protected health information comply with the same restrictions and conditions that apply to the business associate with respect to such information

If the business associate violates a material term of the contract related to this agreement under HIPAA, the Government is authorized to terminate this contract.