Laserfiche WebLink
MUTUAL BAA AND DATA PROTECTION AGREEMENT <br />The responsible party bears reasonable, documented response and notice costs to the extent caused by its breach, <br />subject to the service agreement and applicable law. <br />6. INDIVIDUAL RIGHTS AND GOVERNMENT ACCESS <br />Make designated -record -set information available as reasonably necessary for access, amendment, and <br />accounting -of -disclosures duties within the time needed for the responsible party to meet legal deadlines. <br />Forward a request from an individual, personal representative, attorney, court, regulator, or law -enforcement <br />agency to the party responsible for responding, unless direct response is required by law. <br />Make practices, books, and records relating to PHI available to the U.S. Department of Health and Human <br />Services as required by law. <br />7. PART 2 RECORDS <br />A Part 2 Record may be used or disclosed only as permitted by 42 C.F.R. Part 2 and other applicable law. Each party <br />will preserve required consent limitations and redisclosure restrictions, limit access to authorized personnel, and <br />resist compulsory process that does not satisfy Part 2. A general HIPAA permission does not independently authorize <br />a Part 2 disclosure. <br />The parties will not disclose a Part 2 Record in a civil, criminal, administrative, or legislative proceeding against a <br />patient without the specific consent or court order required by Part 2. Any Part 2 breach or complaint will be handled <br />under Section 5 and the applicable Part 2 breach -notification rules. <br />8. DATA OWNERSHIP, RECORD CUSTODY, AND RETENTION <br />This BAA grants no ownership interest in clinical records, PHI, psychotherapy notes, or Part 2 Records. Record <br />custody and retention follow applicable law, professional duties, the approved EHR arrangement, and the service <br />agreement. Each party remains responsible for records it is legally required to maintain. <br />TERM, TERMINATION, AND RETURN OR DESTRUCTION <br />This BAA begins before the first exchange of PHI and remains effective while either party maintains PHI received or <br />created under the service agreement. A party may terminate for an uncured material privacy breach after written <br />notice and a reasonable cure opportunity, unless immediate termination is required to protect individuals or comply <br />with law. <br />10. GENERAL TERMS <br />This BAA is incorporated into the service agreement. If they conflict on privacy or data protection, the more protective <br />privacy requirement controls. The parties will amend this BAA as needed to remain compliant. No third party is a <br />beneficiary. Electronic signatures and counterparts are permitted. <br />SIGNATURES <br />KITTITAS COUNTY <br />By: <br />Name/Ti e: C( ��� <br />Date: g ^ l S'r —2 ! . <br />REFERENCE AUTHORITIES <br />CONTRACTOR <br />Apple Valley Counseling Services, LLC <br />d/b/a Valley Health and Counseling <br />By: <br />Name/Title: <br />Date: <br />References: 45 C.F.P. Parts 160 and 164, 42 C.F.R. Part 2; chapter 70.02 RCW; and U.S. Department of Health and Human Services <br />sample Business Associate Agreement provisions. These references do not replace review by County counsel or Contractor counsel. <br />Page 2 <br />