Loading...
HomeMy WebLinkAboutSH18-038 QUICKMAR MED MANAGEMENT-BAA Sheriff signedBUSINESS ASSOCIATE AGREEMENT This Business Associate Agreement ("Agreement") is entered between ("Covered Entity") and Med Management Technology LLC ("Business Associate"). 1. Purpose and Intent. Business Associate has agreed to perform certain services for or on behalf of Covered Entity, which services may involve the creation, maintenance, use, transmission or disclosure of Protected Health Information within the meaning of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and its implementing regulations, 45 C.F.R. parts 160 and 164 ("the Privacy and Security Rules"). This Agreement supplements the parties' agreement for services and is intended and shall be interpreted so as to satisfy the requirements for Business Associate contracts as set forth in the Privacy and Security Rules, including 45 C.F.R. §§ 164.314 and .504(e). Business Associate hereby agrees to comply with applicable provisions of the Privacy and Security Rules and to assist Covered Entity with its compliance as explained below. 2. Definitions. Protected Health Information means any information which is created, received, maintained, or transmitted by Business Associate on behalf of Covered Entity, whether oral or recorded in any form or medium, that relates to the past, present, or future physical or mental health or condition of an individual, the provision of health care to an individual, or the past, present, or future payment for the provision of health care to an individual. See 45 C.F.R. § 160.103. Protected Health Information includes Protected Health Information that is maintained in or transmitted by electronic media ("Electronic Protected Health Information"), including but not limited to Protected Health Information maintained on computers, magnetic tape, optical disk, digital memory, etc., or transmitted through the internet, extranet, leased lines, dial-up lines, networks, and the physical movement of Protected Health Information maintained on electronic media. See id. Disclose and disclosure mean, with respect to Protected Health Information, the release, transfer, transmission, provision of access to, or divulging in any other manner of Protected Health Information outside Business Associate's internal operations. Use and uses mean, with respect to Protected Health Information, the creation, maintenance, sharing, transmission, employment, application, utilization, examination or analysis of Protected Health Information within Business Associate's internal operations. Terms used but not otherwise defined in this Agreement shall be defined as set forth in 45 C.F.R. Part 160 and Part 164, Subparts A, C, and E. 3. Obligations and Activities of Business Associate. a. Limits on Use or Disclosure. Business Associate agrees to use or disclose Protected Health Information only as permitted or required by this Agreement or as required by law. b. Safeguards. Business Associate agrees to use appropriate safeguards to prevent the unauthorized use, disclosure, or access to Protected Health Information other than as provided for by this Agreement. Among other things, Business Associate agrees to use appropriate administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of Electronic Protected Health Information that Business Associate creates, receives, maintains, or transmits on behalf of Covered Entity. BUSINESS ASSOCIATE AGREEMENT - 1 55555.0713.5940675.1 C. Mitigation. Business Associate agrees to mitigate, to the extent practicable, any harmful effect caused by a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. d. Reporting. Business Associate agrees to Immediately report to Covered Entity's Privacy Officer any use or disclosure of Protected Health Information not allowed by this Agreement. Business Associate further agrees to immediately report to Covered Entity's Privacy Officer any attempted or successful unauthorized access, use, disclosure, modification, or destruction of Electronic Protected Health Information or interference with information system operations involving Electronic Protected Health Information. e. Agents, Contractors and Subcontractors. Business Associate agrees to ensure that any agent, contractor or subcontractor to whom it provides, discloses or transmits Protected Health Information agrees to the same restrictions and conditions concerning the Protected Health Information that apply through this Agreement to Business Associate. Business Associate shall comply with this section by entering a Business Associate Agreement with such agent, contractor or subcontractor, which contract requires the agent or subcontractor to comply with the terms of this Agreement. f. Access to Information. Upon a request by Covered Entity, Business Associate agrees to provide access to Protected Health Information to Covered Entity as necessary to enable Covered Entity to comply with 45 C.F.R. § 164.524. Business Associate shall provide access to the Protected Health Information in the time and manner designated by Covered Entity. g. Amendment to Information. Upon request by Covered Entity and at Covered Entity's direction, Business Associate agrees to make any amendment(s) to Protected Health Information as necessary to enable Covered Entity to comply with 45 C.F.R. § 164.526. Business Associate shall act on the amendments in the time and manner designated by Covered Entity. h. Accounting of Disclosures, if Business Associate makes any disclosure of Protected Health Information to. any entity other than Covered Entity for any purpose other than for treatment, payment, or health care operations as defined in 45 C.F.R. § 164.501, Business Associate shall document the following information and maintain such documentation for six (6) years: (1) the name and address of the entity to whom the Protected Health Information was disclosed; (2) the date of the disclosure; (3) a brief description of the Protected Health Information disclosed; (4) a brief description of the purpose for the disclosure; and (5) any other information related to such disclosures as required to enable Covered Entity to comply with 45 C.F.R. § 164.528. Upon request by Covered Entity, Business Associate agrees to provide to Covered Entity the information concerning such disclosures as necessary to enable Covered Entity to respond to a request by an individual for an accounting of disclosures of Protected Health Information pursuant to 45 C.F.R. § 164.528. Business Associate shall act in the time and manner designated by Covered Entity. I. Access to Books and Records. Business Associate agrees to make internal practices, books, and records (including policies and procedures and Protected Health Information) relating to the use and disclosure of Protected Health Information on behalf of Covered Entity available to Covered Entity or the Secretary of Health and Human Services, or their designees, to enable them to determine Covered Entity's compliance with the Privacy and Security Rules. Business Associate shall make the documents available in the time and manner designated by Covered Entity or the Secretary. 4. Permitted Uses and Disclosures by Business Associate. a. General Use and Disclosure Provisions. Except as otherwise limited in this Agreement, Business Associate may create, maintain, use, transmit or disclose Protected Health Information on behalf of, or to provide services to, Covered Entity in the course of and for the purpose of providing legal services to Covered Entity, if such use or disclosure of Protected Health Information would BUSINESS ASSOCIATE AGREEMENT - 2 55555.0713.5940675.1 not violate (1) the Privacy and Security Rules if done by Covered Entity or (2) Covered Entity's policies and procedures which limit disclosures to the minimum necessary. b. Additional Use and Disclosure Provisions. (1) Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information for the proper management and administration of the Business Associate or to carryout the legal responsibilities of the Business Associate. (2) Except as otherwise limited in this Agreement, Business Associate may disclose Protected Health Information for the proper management and administration of the Business Associate, provided that disclosures are required by law or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached. (3) Except as otherwise limited in this Agreement, Business Associate may use Protected Health Information to provide data aggregation services to Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(1)(B). (4) Business Associate may use Protected Health Information to report violations of law to appropriate Federal and State authorities, consistent with § 164.5020)(1). 5. Obligations of Covered Entity. 4 a. Notice of Privacy Practices. Covered Entity shall notify Business Associate of any limitation(s) in Covered Entity's notice of privacy practices in accordance with 45 C.F.R. § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of Protected Health Information. b. Changes to Authorization. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose Protected Health Information, to the extent that such changes may affect Business Associate's use or disclosure of Protected Health Information. C. Restrictions on Consent. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of Protected Health Information to which Covered Entity has agreed in accordance with 45 C.F.R. § 164.522, to the extent that such restriction may affect Business Associate's use or disclosure of Protected Health Information. d. Requests in Violation of Privacy Rule. Covered Entity shall not request Business Associate to use or disclose Protected Health Information in any manner that would not be permissible under the Privacy and Security Rules if done by Covered Entity. 6. Term and Termination. a. Term. The term of this Agreement as it relates to the use and disclosure of Protected Health Information shall be effective as of the Effective Date identified below and shall terminate when all of the Protected Health Information provided by Covered Entity to Business Associate, or created, maintained, or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity or, if it is not feasible to return or destroy Protected Health Information, protections are extended to such information, in accordance with the termination provisions in this Section. BUSINESS ASSOCIATE AGREEMENT - 3 55555.0713.5940675.1 b. Termination for Cause. Upon Covered Entity's knowledge of a material breach of the Agreement by Business Associate, Covered Entity shall either: (1) Provide an opportunity for Business Associate to cure the breach or end the violation and, if Business Associate fails to cure the breach or end the violation within the time specified by Covered Entity, Covered Entity shall terminate this Agreement and all related agreements for Business Associate's services involving the creation, maintenance, use, receipt, transmission or disclosure of Protected Health Information; (2) Immediately terminate this Agreement together with any related agreement for Business Associate's services involving the creation, use, maintenance, transmission, receipt, or disclosure of Protected Health Information if Business Associate has breached a material term of this Agreement and cure is not possible; or (3) If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary. C. Effect of Termination. Except as provided in paragraph (1) of this section, upon termination of this Agreement for any reason, Business Associate shall return or destroy all Protected Health Information received from Covered Entity, or created, maintained or received by Business Associate on behalf of Covered Entity. This provision shall apply to Protected Health Information that is In the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the Protected Health Information. In the event that Business Associate determines that returning or destroying the Protected Health Information is not feasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon Covered Entity's determination that return or destruction of Protected Health Information is not feasible, Business Associate shall extend the protections of this Agreement to such Protected Health Information and limit further uses and disclosures of such Protected Health Information to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such Protected Health Information. 7. Miscellaneous. a. Regulatory References. A reference in this Agreement to a section in the Privacy and Security Rules means the section as in effect or as amended. b. Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the Privacy and Security Rules and HIPAA. C. Survival. The respective rights and obligations of Business Associate under Section 6(c), "Effect of Termination," of this Agreement shall survive the termination of this Agreement. d. Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the Privacy and Security Rules. e. Governing Law. This Agreement shall be construed to comply with the requirements of the Privacy and Security Rules. All other aspects of this Agreement shall be governed under the laws of the State of Idaho and venue for any actions relating to this Agreement shall be in Ada County, Idaho. f. Assignment/Subcontracting. This Agreement shall inure to the benefit of and be binding upon the parties hereto and their respective legal representatives, successors and assigns. Business Associate may not assign or subcontract rights or obligations under this Agreement without the express written consent of Covered Entity. Covered Entity may assign its rights and obligations under this Agreement to any successor or affiliated entity. BUSINESS ASSOCIATE AGREEMENT - 4 55555.0713.5940675.1 g. Entire Agreement. This Agreement contains the entire agreement between the parties as it relates to the use or disclosure of Protected Health Information, and supersedes all prior discussions, negotiations and services relating to the same. h. Cooperation. Business Associate agrees to cooperate with Covered Entity and assist Covered Entity in complying with requirements under HIPAA or the Privacy and Security Rules. Business Associate shall make itself and its agents, affiliates, subsidiaries, subcontractors or employees available to Covered Entity, at no cost to Covered Entity, to testify as witnesses in the event of litigation or administrative proceedings against Covered Entity, its directors, officers or employees based upon a claimed violation of HIPAA, the Privacy and Security Rules, or other laws relating to security and privacy. 8. Effective Date. The Effective Date of this Agreement shall be , 2. 14. do(& . COVERED ENTITY BUSINESS ASSOCIATE Med Management Technology LLC By: Print Name:Stan Turner Print Title: President/Privacy Officer Date: BUSINESS ASSOCIATE AGREEMENT - 5 55555.0713.5940675.1