HomeMy WebLinkAboutSH20-025 Comprehensive Healthcare 2021 HSA - BSAExhibit "A"
BUSINESS ASSOCIATE/ QUALIFIED SERVICE
ORGANIZATION AGREEMENT
This Business Associate/Qualified Service Organization
Agreement ("BA/QSO Agreement") is
between
Comprehensive Healthcare
(Covered Entity)
and
(Kittitas County Jail)
(Business Associate)
Page 1 of 8
B.B.A Attachment
Recitals
Covered Entity will make available and/or provide certain Protected Health Information and Records (as
defined below) to Business Associate in the course of the parties' relationship.
Business Associate will make available and/or provide certain Protected Health Information and Records (as
defined below) to Covered Entity in the course of the parties' relationship.
In order to protect the privacy of the Protected Health Information and to comply with HIPAA and the HIPAA
Regulations (as defined below) as well as the Confidentiality of Substance Use Disorder Patient
Records, 42 C.F.R. Part 2; Covered Entity and Business Associate desire to enter into this BA/QSO
Agreement setting forth the terms and conditions of use and disclosure of Protected Health
Information.
In consideration of the mutual promises set forth below, the parties agree as follows:
Article 1: Definitions
1.1 Business Associate. "Business Associate" shall mean (insert name of Business Associate).
1.2 Confidentiality Rule. "Confidentiality Rule" shall mean the Confidential of Substance Use Disorder
Patient Records in 42 CFR Part 2.
1.3 Covered Entity. "Covered Entity" shall mean Comprehensive Healthcare
1.4 Individual. "Individual" shall have the same meaning as the term "individual" in 45 CFR § 164.501 and
shall include a person who qualifies as a personal representative in accordance with 45 CFR §
164.502(g).
1.5 HIPAA. "HIPAA" means the Health Insurance Portability & Accountability Act of 1996, P.L. 104-91.
1.6 HIPAA Regulations. "HIPAA Regulations" mean the regulations promulgated under HIPAA by the U.S.
Department of Health and Human Services, including the Privacy Rule.
1.7 Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health
Information in 45 CFR Part 160 and Part 164, Subparts A and E.
Page 2 of 8
B.B.A Attachment
1.8 Protected Health Information. "Protected Health Information" shall have the same meaning as the
term "protected health information" in 45 CFR § 164.501, limited to the information created or
received by Business Associate from or on behalf of the Covered Entity. The term Protected Health
Information shall also include "Records" as provided herein.
1.9 Records. "Records" shall have the same meaning as the term "records" in 42 CFR §2.11.
1.10 Required By Law. "Required By Law" shall have the same meaning as the term "required by law" in 45
CFR § 164.501.
1.11 Secretary. "Secretary" shall mean the Secretary of the Department of Health and Human Services or
the Secretary's designee.
1.12 General Rule. Capitalized terms not otherwise defined in this BA Agreement shall have the same
meaning as those terms in the Privacy Rule.
1.13 Qualified Service Organization. "Qualified Service Organization" shall have the same meaning as the
term "Qualified Service Organization" in 42 C.F.R. § 2.11.
1.14 Substance Abuse Confidentiality Regulations. "Substance Abuse Confidentiality Regulations" shall
mean the regulations promulgated by the U.S. Department of Health and Human Services, Substance
Abuse and Mental Health Services Administration, including the Confidentiality Rule.
Article 2: Obligations and Activities of Business Associate
2.1 Prohibitions. Business Associate agrees to not use or disclose Protected Health Information other
than as permitted or required by the BA/QSO Agreement or as required by applicable federal or state
laws and regulations.
2.2 Qualified Service Organization. Business Associate acknowledges that it may also be a Qualified
Service Organization as defined in 42 CFR 2.11 and as such: (i) acknowledges that, to the extent it
receives, stores, processes or otherwise deals with any information, whether recorded or not, relating
to a patient received or acquired by a federally assisted alcohol or drug program, it is fully bound by
the regulations in 42 CFR Part 2; and (ii) if necessary, will resist in judicial proceedings any efforts to
obtain access to any information, whether recorded or not, relating to a patient received or acquired
by a federally assisted alcohol or drug program, except as permitted by 42 CFR Part 2.
Page 3 of 8
B.B.A Attachment
2.3 Safeguards. Business Associate agrees to implement and use appropriate safeguards and comply with
Subpart C of 45 CFR Part 164 to prevent use or disclosure of the Protected Health Information other
than as provided for by this BA/QSO Agreement. Agrees that, when Business Associate uses, discloses,
or requests Protected Health Information, it will limit the use, disclosure, or request to the minimum
necessary. Business Associate acknowledges that in receiving, transmitting, transporting, storing,
processing, or otherwise dealing with any Protected Health Information or Records received from the
Covered Entity identifying or otherwise relating to the patients within the Covered Entity, it is fully
bound by the provisions of the federal regulations governing the Confidentiality of Substance Use
Disorder Patient Records, 42 C.F.R. Part 2; and the Health Insurance Portability and Accountability Act
(HIPAA), 4S C.F.R. Parts 142, 160, 162, and 164.
2.4 Mitigation. Business Associate agrees to mitigate promptly, to the extent practicable, any harmful
effect that is known to Business Associate of a use or disclosure of Protected Health Information by
Business Associate in violation of the BA Agreement, the Privacy Rule, Confidentiality Rule or other
applicable federal or state law and regulations.
2.5 Reports of Improper Use or Disclosure. Business Associate agrees to immediately report to Covered
Entity any use or disclosure of the Protected Health Information not provided for by this BA Agreement
of which it becomes aware. Business Associate also agrees to immediately report to Covered Entity
about any complaint that the Business Associate receives concerning the handling of Protected Health
Information or compliance with this BA Agreement. Business Associate must notify Covered Entity of
any Breach relating to Unsecured Protected Health Information, which notice shall be in compliance
with the requirements of the HITECH Act and shall be given to Covered Entity at its designated address
for receiving such notices, as soon as practicable and without unreasonable delay, and in no case later
no later than five (5) business days after such breach is discovered by Business Associate. Such notice
shall include, to the extent possible, the identification of each individual whose Unsecured Protected
Health Information has been, or is reasonably believed by Business Associate to have been breached,
along with other available information that Covered Entity may be required to include in its
notification to the individual. Notice to Covered Entity may be given by email, return receipt requested
or certified mail, return receipt requested. If Business Associate learns subsequent to its initial
notification to Covered Entity of any additional information that Covered Entity may need for its
required notification to individuals, Business Associate shall promptly notify Covered Entity of such
information in the same manner as specified above.
2.6 Disclosures to Agents and Subcontractors. In accordance with 4S CFR 164.502(e)(1)(ii), 164.308(b)(2),
and 42 CFR Part 2 if applicable, ensure that any subcontractors that create, receive, maintain, or
transmit Protected Health Information on behalf of the business associate agree to the same
restrictions, conditions, and requirements that apply to the business associate with respect to such
information;
Page 4 of 8
B.B.A Attachment
2.7 Access. To enable the Covered Entity to fulfill its obligations under the Privacy Rule, Business
Associate agrees to make Protected Health Information in Designated Record Sets that are maintained
by Business Associates or its agents or subcontractors available to Covered Entity for inspection and
copying within ten (10) days of a request by Covered Entity. If an Individual requests inspection and
copying of Protected Health Information directly from Business Associate or its agents or
subcontractors, Business Associate shall notify the Covered Entity in writing within five (5) business
days of receipt of the request, and shall defer to, and comply with, Covered Entity's direction in a
timely manner regarding the response to the Individual regarding the request for inspection and
copying.
2.8 Amendment. To enable the Covered Entity to fulfill its obligations under the Privacy Rule, Business
Associate agrees to make any amendment(s) to Protected Health Information in a Designated Record
Set that are maintained by Business Associate or its agents or subcontractors that the Covered Entity
directs or agrees to pursuant to 45 CFR § 164 within ten (10) days of a request by Covered Entity. If an
Individual requests amendment of Protected Health Information directly from Business Associate or its
agents or subcontractors, Business Associate shall notify the Covered Entity in writing within five (5)
business days of receipt of the request, and shall defer to, and comply with, Covered Entity's direction
in a timely manner regarding the response to the Individual regarding the request for amendment.
2.9 Federal Government Officials. Business Associate agrees to make internal practices, books, and
records, including policies and procedures and Protected Health Information, relating to the use and
disclosure of Protected Health Information received from, or created or received by Business Associate
on behalf of, Covered Entity available to the Secretary as designated by the Secretary, for purposes of
the Secretary determining Covered Entity's compliance with the Privacy Rule. Business Associate shall
notify Covered Entity regarding any Protected Health Information that Business Associate provides to
the Secretary concurrently with providing such Protected Health Information to the Secretary, and
upon Covered Entity's request, shall provide Covered Entity with a duplicate copy of such Protected
Health Information.
2.10 Documentation of Disclosures. Business Associate agrees to implement a process for documenting
such disclosures of Protected Health Information and information related to such disclosures as would
be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures
of Protected Health Information in accordance with 45 CFR § 164.528.
2.11 Accounting of Disclosures. Business Associate agrees to provide to Covered Entity the information
collected in accordance with Section 2.9 of this BA Agreement within ten (10) days of the Covered
Entity's request in order to permit Covered Entity to respond to a request by an Individual for an
accounting of disclosures of Protected Health Information in accordance with 45 CFR § 164.528. If an
individual requests an accounting directly from Business Associate or its agents or subcontractors,
Business Associate must notify Covered Entity in writing within five (5) business days of the request,
and shall defer to, and comply in a timely manner with, Covered Entity's direction regarding the
response to the Individual regarding the request for an accounting.
Page 5 of 8
B.B.A Attachment
Article 3: Permitted Uses and Disclosures by Business Associate
3.1 Specific Purposes. Business associate may only use or disclose protected health information as
required or permitted by law.
3.2 Legal Responsibilities. Except as otherwise limited in this Agreement, Business Associate may use
Protected Health Information for the proper management and administration of the business associate
or to carry out the legal responsibilities of the business associate.
3.3 Reporting law Violations. Business Associate may use Protected Health Information to report
violations of law to appropriate Federal and State authorities, consistent with § 164.502(j)(1).
Article 4: Obligations of Covered Entity
4.1 Notice of Privacy Practices. Covered Entity shall notify Business Associate of any limitation(s) in its
notice of privacy practices of Covered Entity in accordance with 45 CFR § 164.520, to the extent that
such limitation may affect Business Associate's use or disclosure of Protected Health Information.
4.2 Individual Permission. Covered Entity shall notify Business Associate of any changes in, or revocation
of, permission by Individual to use or disclose Protected Health Information, to the extent that such
changes may affect Business Associate's use or disclosure of Protected Health Information.
4.3 Restrictions. Covered Entity shall notify Business Associate of any restriction to the use or disclosure
of Protected Health Information that Covered Entity has agreed to in accordance with 45 CFR §
164.522 and 42 CFR Part 2 , to the extent that such restriction may affect Business Associate's use or
disclosure of Protected Health Information.
4.4 Prohibited Requests. Covered Entity shall not request Business Associate to use or disclose Protected
Health Information in any manner that would not be permissible under the Privacy Rule or
Confidentiality Rule if done by Covered Entity.
Article 5: Term and Termination
5.1 Term. The Term of this BA Agreement shall be effective as of the date signed, and shall terminate
when all of the Protected Health Information provided by Covered Entity to Business Associate, or
created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to
Covered Entity, or, if it is infeasible to return or destroy Protected Health Information, protections are
extended to such information, in accordance with the termination provisions in this Section.
Page 6 of 8
B.B.A Attachment
5.2 Termination for Cause. Upon Covered Entity's knowledge of a material breach by Business Associate,
Covered Entity shall either:
A. Provide an opportunity for Business Associate to cure the breach or end the violation, and
terminate this Agreement if Business Associate does not cure the breach or end the violation
within the time specified by Covered Entity;
B. Immediately terminate this Agreement if Business Associate has breached a material term of
this Agreement and cure is not possible; or
C. If neither termination nor cure is feasible, Covered Entity shall report the violation to the
Secretary.
5.3 Effect of Termination.
A. Except as provided in paragraph (B) of this section, upon termination of this Agreement, for
any reason, Business Associate shall return or destroy all Protected Health Information
received from Covered Entity or created or received by Business Associate on behalf of
Covered Entity. This provision shall apply to Protected Health Information that is in the
possession of subcontractors or agents of Business Associate. Business Associate shall retain
no copies of the Protected Health Information.
B. In the event that Business Associate determines that returning or destroying the Protected
Health Information is infeasible, Business Associate shall provide to Covered Entity notification
of the conditions that make return or destruction infeasible. Business Associate shall
thereafter extend the protections of this Agreement to such Protected Health Information and
limit further uses and disclosures of such Protected Health Information to those purposes that
make the return or destruction infeasible, for so long as Business Associate maintains such
Protected Health Information.
SA Survival. The respective rights and obligations of Business Associate under this Article S shall survive
the termination of this BA Agreement.
Article 6: Miscellaneous
6.1 Regulatory References. A reference in this Agreement to a section in the Privacy Rule means the
section as in effect or as amended,
Page 7of8
B.B.A Attachment
6.2 Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time
to time as is necessary for Covered Entity to comply with the requirements of the Privacy Rule and the
Health Insurance Portability and Accountability Act of 1996, Pub. L. No. 104-191 and the
Confidentiality Rule.
6.3 Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply
with the Privacy Rule.
6.4 State Law. In addition to HIPAA and the HIPAA Regulations, Business Associate shall comply with all
applicable state and federal privacy and security laws.
6.5 Notices. Under the terms of this BA Agreement, either party shall be deemed as being given notice, if
delivered personally, or if mailed by first class United States mail, postage prepaid, and addressed as
follows:
If to Covered Entity: If to Business Associate:
Comprehensive Healthcare Kittitas County Jail
PO Box 959 205 West 5h Ave, Suite 1
Yakima, WA 98907 Ellensburg, WA 98926
The parties mutually agree as of the date above to this agreement.
dialy,CEO Date Clay Myers, Sheriff Date
Com rehensive Healthcare Sheriff, Kittitas County
Page 8 of 8
B.B.A Attachment