Iowa Health Information Network BUSINESS ASSOCIATE AGREEMENT

Transcription

1 Iowa Health Information Network BUSINESS ASSOCIATE AGREEMENT THIS BUSINESS ASSOCIATE AGREEMENT (the Agreement ) is made entered into and effective on the day of, 201_ ( Effective Date ) by and between the Office of Health Information Technology of the Iowa Department of Public Health ( Business Associate ) and ( Covered Entity ) for purposes of complying with the Health Insurance Portability and Accountability Act of 1996, Pub. L. No ( HIPAA ), as amended by the Health Information Technology for Economic Clinical Health Act, Publ. L. No ( HITECH ), and the implementing regulations promulgated thereunder that are more specifically referred to as the Standards for Privacy of Individually Identifiable Health Information at 45 C.F.R. Parts 160 and 164, Subparts A and E (the Privacy Rule ); Health Insurance Reform: Security Standards; Final Rules at 45 C.F.R Parts 160 and 164, Subparts A and C (the Security Rule ); Breach Notification for Unsecured Protected Health Information; Interim Final Rule at 45 C.F.R. Part 164, Subpart D (the Breach Notification Rule ); Administrative Simplification: Enforcement: Interim Final Rule at 45 C.F.R. Part 160 (the Enforcement Rule ); and the Final Omnibus Rule Modifying the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules (collectively, and as may be amended from time to time, HIPAA ). Covered Entity and Business Associate are collectively referred to as the Parties. RECITALS A. Business Associate provides a statewide health information exchange ( HIE ) known as the Iowa Health Information Network ( IHIN ), which electronically connects Participants with different electronic health records or other clinical or public health information systems for purposes of payment, treatment, health care operations and population health. The IHIN is not a central data repository. It is a network system that facilitates the location and electronic transfer of participating patient data. B. Business Associate has entered into an agreement with Covered Entity ( Participation Agreement ) governing Covered Entity s participation in the IHIN and services provided by Business Associate in connection with the IHIN. C. Covered Entity is a covered entity as such term is defined under HIPAA. As a HIPAA covered entity, Covered Entity is required to comply with various privacy and security requirements relating to Protected Health Information imposed by HIPAA, other applicable State and Federal laws, and agreements to which Covered Entity is a party. December 2013

2 D. By providing the services according to the Participation Agreement, Business Associate shall become a business associate of Covered Entity as such term is defined under HIPAA. E. The purpose of this Agreement is to satisfy the requirements of HIPAA that Business Associate provide satisfactory written assurances to Covered Entity that it will comply with the applicable requirements of HIPAA. NOW THEREFORE, In consideration of the mutual covenants, promises and agreements contained herein, the Parties agree as follows: 1. Definitions. Unless otherwise defined in this Agreement, including the definitions stated in the Preamble and Recitals, which are incorporated into this Section 1 by reference, capitalized terms have the meanings ascribed to them under HIPAA for purpose of this Agreement: (a) Individual shall have the meaning given to such term under the Privacy Rule, including, but not limited to, 45 C.F.R. Section and shall include a person who qualifies as a personal representative in accordance with 45 C.F.R. Section (g). (b) Protected Health Information or PHI shall have the meaning ascribed to protected health information in 45 C.F.R. Section (c) Required by Law shall have the meaning ascribed to this term in 45 C.F.R. Section (d) Secretary shall have the meaning ascribed to this term in 45 C.F.R. Section (e) Unsecured PHI shall have the meaning ascribed to this term in 45 C.F.R. Section (f) Workforce means employees, volunteers, trainees, and other persons or entities whose conduct, in the performance of work for a Covered Entity, is under the control of such entity, whether or not they are paid by the covered entity. 2. Obligations of Business Associate as to PHI. With regard to the use and/or disclosure of PHI by the Business Associate, Business Associate agrees as follows: (a) Limitations on Uses and Disclosures of PHI. Business Associate shall not and shall ensure that its Workforce, subcontractors and agents do not use or disclose PHI in any manner that would constitute a violation of HIPAA or any other applicable State or Federal law or regulation governing the privacy of PHI. Business Associate may use or disclose PHI only as permitted under the terms of this Agreement and the Participation Agreement and as permitted by HIPAA or other applicable State or Federal law not preempted by HIPAA. 2

3 (b) Safeguards to Protect PHI. Business Associate will implement administrative, physical and technical safeguards that reasonably and appropriately protect the confidentiality, integrity and availability of the PHI, including implementing the requirements of the Security Rule relating to electronic PHI and applicable to Business Associate. (c) Breach Notification. Business Associate shall notify Covered Entity as soon as practicable, but no later than seven (7) days after it is known to Business Associate, or, by exercising reasonable diligence would have been known to Business Associate, of any event involving the access, use, or disclosure of Unsecured PHI in violation of HIPAA or this Agreement ( Breach Event ). Business Associate shall be deemed to have knowledge of a Breach Event if such Breach Event is known, or by exercising reasonable diligence would have been known, to any person, other than a person involved in the Breach Event, who is a workforce member, subcontractor, or agent of Business Associate (determined in accordance with the federal common law of agency). Business Associate will reasonably cooperate with Covered Entity in its investigation of any Breach Event. Business Associate shall notify its Workforce and any agents or subcontractors with access to PHI of Business Associate s obligation to immediately notify Covered Entity of a Breach Event. Business Associate will mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a Breach Event. (d) Subcontractors. Business Associate will obtain and maintain a written agreement with each subcontractor or agent of Business Associate that has or will have access to PHI. Subcontractor or agent shall agree to be bound by the same restrictions, terms, and conditions that apply to Business Associate pursuant to this Agreement with respect to such PHI. (e) Access to Information. In the event any Individual requests access to PHI directly from Business Associate, Business Associate shall forward such request to Covered Entity within three (3) business days. (f) Availability of PHI for Amendment. In the event any Individual requests an amendment of PHI in accordance with 45 C.F.R. Section directly from Business Associate, Business Associate shall forward such request to Covered Entity within three (3) business days. (g) Availability of Internal Practices, Books and Records. Business Associate agrees to make available to the Secretary, upon request and at reasonable times, Business Associate s internal practices, books and records relating to the use and disclosure of PHI. (h) Documentation and Accounting of Disclosures. Business Associate agrees to document disclosures of PHI made by Business Associate, in accordance with its auditing capabilities, which are necessary for Covered Entity to provide an accounting of such disclosures to an Individual. Business Associate shall forward an accounting of such disclosures for a specific Individual within twenty (20) business days of receipt of Covered Entity s written request for such accounting. 3

4 (i) Compliance with Laws and Regulations. Business Associate understands that Covered Entity is subject to State and Federal laws governing the confidentiality of PHI. Business Associate agrees to abide by all such laws, whether or not fully articulated herein. The Parties agree to negotiate, in good faith, any amendments to this Agreement which may be necessary to comply with any applicable State or Federal law including but not limited to any future amendments to HIPAA. 3. Permitted Uses and Disclosures of PHI by Business Associate. Business Associate warrants that Business Associate shall use or disclose PHI only as follows: (a) in connection with fulfilling its duties and obligations under this Agreement and the Participation Agreement; (b) as necessary for the proper management and administration of Business Associate; or (c) as Required By Law or to carry out the legal responsibilities of Business Associate. 4. Obligations of Covered Entity. With regard to the use and/or disclosure of PHI by the Business Associate, Covered Entity agrees as follows: (a) Compliance with Privacy Rule. Covered Entity, and its agents, Workforce and subcontractors: (i) shall comply with the Privacy Rule in its use or disclosure of PHI; (ii) shall not use or disclose PHI in any manner that violates applicable Federal and State laws or the Participation Agreement; and (iii) shall not request Business Associate to use or disclose PHI in any manner that violates applicable Federal and State laws. (b) Notice of Privacy Practices. Covered Entity shall provide Individuals with a notice of privacy practices (the Notice ) and shall provide Business Associate a copy of the Notice currently in use upon request. (c) Revocation of Authorizations. Covered Entity shall promptly notify Business Associate, in writing, of any changes in or revocation of, an Individual s permission to use or disclose PHI, if such change or revocation affects Business Associate s permitted or required uses and disclosures. (d) Restrictions on Uses and Disclosures. Covered Entity shall promptly notify Business Associate in writing of any arrangements permitted or required of the Covered Entity, including, but not limited to, restrictions on use and/or disclosure of PHI agreed to by the Covered Entity pursuant to 45 C.F.R. Section , that may impact the use and/or disclosure of PHI by the Business Associate under this Agreement. Any requests for restrictions shall be governed by the Participation Agreement and applicable IHIN policies. 4

5 5. Term and Termination (a) Term. This Agreement shall become effective on the Effective Date set forth above and shall terminate upon the termination or expiration of the Participation Agreement or as otherwise provided in this Section 5. (b) Termination for Cause (i) Where either Party has knowledge of a material breach by the other Party, the non-breaching Party shall provide the breaching Party with an opportunity to cure. Where said breach is not cured within thirty (30) days of the breaching Party s receipt of written notice from the non-breaching Party of said breach, the non-breaching Party may terminate this Agreement. Notwithstanding anything to the contrary in the foregoing, the Agreement shall not be terminated by the Covered Entity so long as the Business Associate commences to cure the breach within 30 days and diligently pursues the cure to completion. (c) Effect of Termination. Upon termination of this Agreement for any reason, the Participation Agreement shall automatically terminate. The parties agree that return or destruction of all PHI or related information is not feasible. Business Associate shall extend the protections of this Agreement to such PHI at no cost to Covered Entity and limit further uses and disclosures of such PHI to those purposes that make the return or destruction of the PHI infeasible. 6. Miscellaneous (a) Amendment. If any of the regulations promulgated under HIPAA are amended or interpreted in a manner that renders this Agreement inconsistent therewith, the Parties shall, in good faith, negotiate an amendment to this Agreement to the extent necessary to comply with such amendments or interpretations. No amendments or additions to this Agreement are binding unless signed in writing by both Parties. (b) Inconsistency with HIPAA. In the event of an inconsistency between the provisions of this Agreement and HIPAA, HIPAA shall control. Where provisions of this Agreement are more restrictive than those mandated in the HIPAA but are permitted by the HIPAA, the provisions of the Agreement shall control. (c) Survival. The respective rights and obligations of the parties under this Agreement which require compliance after termination of this Agreement shall survive the termination. (d) Notices. All notices, requests, approvals, demands and other communications required or permitted to be given under this Agreement shall be in writing and delivered either personally, or by certified mail with postage 5

6 prepaid and return receipt requested, or by overnight courier to the party to be notified. All communications will be deemed given when received. The addresses of the parties shall be as follows; or as otherwise designated by any party through notice to the other party: If to Covered Entity: with a copy to: If to Business Associate: Executive Director Office of Health IT Iowa Department of Public Health Lucas State Office Building 321 East 12 th St. Des Moines, IA (e) Severability. In the event any provision of this Agreement violates any applicable statute, regulation or rule of law such provision shall be ineffective to the extent of such violation without invalidating any other provision of this Agreement. (f) Additional Terms. All choice of law, assignment and standards agreements/requirements as set forth in the Participation Agreement and its attachments shall be incorporated here. In the event any term or condition of this Agreement conflicts with the Participation Agreement and its attachments the Participation Agreement shall control. (g) Disclaimer. IN NO EVENT SHALL EITHER PARTY BE LIABLE FOR ANY INDIRECT, SPECIAL, EXEMPLARY, INCIDENTAL, CONSEQUENTIAL OR PUNITIVE DAMAGES ARISING OUT OF OR RELATING TO THIS AGREEMENT OR THE BREACH THEREOF, INCLUDING, WITHOUT LIMITATION, LOST PROFITS, LOST DATA, BUSINESS INTERRUPTIONS OR OTHER ECONOMIC LOSS ARISING OUT OF OR RELATED TO THIS AGREEMENT. THE DISCLAIMERS SET FORTH IN THIS AGREEMENT SHALL APPLY EVEN IF THE PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. 6

7 (h) Entire Agreement. This Agreement constitutes the entire agreement of the Parties with regard to the subject matter hereof and cancels and supersedes any prior business associate agreements between the parties. It is expressly understood and agreed that no verbal representation, promise or condition, whether made before or after signing of this Agreement, shall be binding upon the Parties. IN WITNESS WHEREOF, each of the undersigned has duly executed this Agreement on behalf of the party and on the date set forth below. COVERED ENTITY BUSINESS ASSOCIATE By: By: Name: Name: Title: Title: Date: Date: 7