Agreement CPWI Prevention Services

Home Browse Search

ATTACHMENT 4 HIPAA Compliance Preamble: This section of the Contract is the Business Associate Agreement as required by HIPAA. 1. Definitions. a. "Business Associate," as used in this Contract, means the "Contractor'' and generally has the same meaning as the term "business associate" at 45 CFR 160.103. Any reference to Business Associate in this Contract includes Business Associate's employees, agents, officers, Subcontractors, third party contractors, volunteers, or directors. b. "Business Associate Agreement" means this HIPAA Compliance section of the Contract and includes the Business Associate provisions required by the U.S. Department of Health and Human Services, Office for Civil Rights. c. "Breach" means the acquisition, access, use, or disclosure of Protected Health Information in a manner not permitted under the HIPAA Privacy Rule which compromises the security or privacy of the Protected Health Information, with the exclusions and exceptions listed in 45 CFR 164.402. d. "Covered Entity" means DSHS, a Covered Entity as defined at 45 CFR 160.103, in its conduct of covered functions by its health care components. e. "Designated Record Set" means a group of records maintained by or for a Covered Entity, that is: the medical and billing records about Individuals maintained by or for a covered health care provider; the enrollment, payment, claims adjudication, and case or medical management record systems maintained by or for a health plan; or Used in whole or part by or for the Covered Entity to make decisions about Individuals. f. "Electronic Protected Health Information (EPHI)" means Protected Health Information that is transmitted by electronic media or maintained in any medium described in the definition of electronic media at 45 CFR 160.103. g. "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, as modified by the American Recovery and Reinvestment Act of 2009 ("ARRA"), Sec. 13400 -13424, H. R. 1 (2009) (HITECH Act). h. "HIPAA Rules" means the Privacy, Security, Breach Notification, and Enforcement Rules at 45 CFR Parts 160 and Part 164. i. "lndividual(s)" means the person(s) who is the subject of PHI and includes a person who qualifies as a personal representative in accordance with 45 CFR 164.502(9). j. "Minimum Necessary" means the least amount of PHI necessary to accomplish the purpose for which the PHI is needed. Washington State Health Care Authority Page 53 of90 HCA Contract No. K3924