Business Associate Agreement

Transcription

1 Business Associate Agreement This Agreement is entered into as of ("Effective Date"), between ( Covered Entity ), and ( Business Associate ). RECITALS WHEREAS, Business Associate provides services on behalf of Covered Entity that require Covered Entity to disclose certain Protected Health Information ("PHI") of its patients to Business Associate WHEREAS, the parties desire to enter into this Agreement to permit Business Associate to access and/or receive PHI from Covered Entity that can be used or disclosed only in accordance with this Agreement and the requirements of the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), the Health Information Technology for Economic and Clinical Health Act of 2009 ("HITECH"), and their accompanying regulations. NOW THEREFORE, the parties for good and valuable consideration agree as follows: I. Definitions Catch-all definition: Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in the Privacy Rule. Specific definitions: A. Business Associate. "Business Associate" shall mean. B. Covered Entity. "Covered Entity" shall mean. C. Individual. "Individual" shall have the same meaning as the term "individual" in 45 CFR and shall include a person who qualifies as a personal representative in accordance with 45 CFR (g). D. Privacy Rule. "Privacy Rule" shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR part 160 and part 164, subparts A and E, as amended by HITECH effective February 17, compliance with all Federal and State laws and regulations. Page 1

2 E. Protected Health Information. "Protected Health Information or PHI shall have the same meaning as the term "protected health information" in 45 CFR , limited to the information created or received by Business Associate from or on behalf of Covered Entity. F. Required By Law. "Required By Law" shall have the same meaning as the term "required by law" in 45 CFR G. Secretary. "Secretary" shall mean the Secretary of the Department of Health and Human Services or his designee. II. Obligations and Activities of Business Associate A. Business Associate shall not, and shall ensure that its directors, officers, employees, contractors and agents do not, use PHI other than as permitted or required by this Agreement or as Required By Law, including without limitation, the Privacy Rule. The permitted uses of PHI by Business Associate are set forth in Section III of this Agreement. B. Business Associate shall not, and shall ensure that its directors, officers, employees, contractors and agents do not, disclose PHI received from Covered Entity in any manner unless such disclosure would be permitted by Covered Entity under its HIPAA privacy policies, or as otherwise expressly permitted under this Agreement or Required By Law. C. Business Associate shall comply with all applicable HIPAA policies adopted by Covered Entity including, without limitation, Covered Entity's policies on: (i) an individual's access to his or her own PHI; (ii) amendment of an individual's PHI; (iii) the provision of an accounting to an individual of disclosures of his or her PHI; and (iv) any additional privacy and security policies adopted by Covered Entity or imposed on Business Associate under HITECH effective February 17, 2010 or as otherwise specified herein. Covered Entity shall provide Business Associate with a copy of any HIPAA policy applicable to Business Associate. D. Business Associate shall use appropriate safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement. Upon request, Business Associate shall provide Covered Entity with a description of its privacy safeguards. E. Business Associate shall mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the requirements of this Agreement. F. Business Associate shall promptly report to Covered Entity any use or disclosure of PHI in violation of this Agreement by Business Associate, its directors, officers employees, contractors, agents or other third parties of which it becomes aware. compliance with all Federal and State laws and regulations. Page 2

3 G. Business Associate shall ensure that any agent, including a subcontractor, to whom it provides PHI agrees to the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. H. Business Associate shall make its internal practices, books, and records relating to the use and disclosure of PHI available to the Secretary, in a timely manner for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule. This provision shall not apply to PHI that is subject to the attorney-client or the attorney work product privilege or which is excepted from access under 45 CFR I. Business Associate shall document its disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR J. Business Associate shall provide to Covered Entity or an Individual, in a timely manner, information collected in accordance with Section II of this Agreement, to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR K. Notwithstanding any provision to the contrary, Business Associate shall not disclose, other than to Covered Entity, communications, information, legal advice or work product with respect to Covered Entity that is subject to the attorney-client or the attorney work product privilege to the Secretary or to any other government agency, person, entity or organization, without first notifying Covered Entity and receiving Covered Entity's prior written approval. Unless and until directed otherwise by Covered Entity in writing, Business Associate will undertake all reasonable efforts to preserve, defend and assert on Covered Entity's behalf the attorney-client and the attorney work product privileges as applicable to any communication, information, legal advice or work product with respect to Covered Entity to which access, or for which disclosure is sought by the Secretary or by any other government agency, person, entity or organization. III. Permitted Uses and Disclosures by Business Associate General Use and Disclosure Provisions Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of the Covered Entity provided that such use or disclosure would not violate the Privacy Rule or the minimum necessary policies and procedures of the Covered Entity. Specific Use and Disclosure Provisions compliance with all Federal and State laws and regulations. Page 3

4 A. Except as otherwise limited in this Agreement, Business Associate may use PHI for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate. B. Except as otherwise limited in this Agreement, Business Associate may disclose PHI for the proper management and administration of the Business Associate, provided that disclosures are Required By Law, or Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will remain confidential and used or further disclosed only as Required By Law or for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached. C. Except as otherwise limited in this Agreement, Business Associate may use PHI to provide data aggregation services relating to the health care operations of Covered Entity as permitted by 42 CFR (e)(2)(i)(B). D. Business Associate may use PHI to report violations of law to appropriate Federal and State authorities, consistent with 42 CFR (j)(1). IV. Obligations of Covered Entity A. Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 CFR , to the extent that such limitation may affect Business Associate's use or disclosure of PHI. B. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an Individual to use or disclose his/her PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI. C. Covered Entity shall notify Business Associate of any restriction to the use or disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR , to the extent that such restriction may affect Business Associate's use or disclosure of PHI. V. Permissible Requests by Covered Entity Covered Entity shall not request Business Associate to use or disclose PHI in any manner that would not be permissible under the Privacy Rule if done by Covered Entity. VI. Term and Termination A. Term. The Term of this Agreement shall commence on the Effective Date and remain in effect for a period of one (1) year. This Agreement shall thereafter automatically renew for successive one (1) year terms unless Business Associate or compliance with all Federal and State laws and regulations. Page 4

5 Covered Entity terminates this Agreement in accordance with the termination provisions in this Section. B. Termination for Cause. Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall either: (1) Provide an opportunity for Business Associate to cure the breach or end the violation and terminate this Agreement if Business Associate does not cure the breach or end the violation within the time specified by Covered Entity; (2) Immediately terminate this Agreement if Business Associate has breached a material term of this Agreement and cure is not possible; or (3) If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary. C. Effect of Termination. (1) Except as provided in paragraph (2) of this Section, upon termination of this Agreement, for any reason, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity under this Agreement and maintained in any form. This provision shall apply to PHI that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the PHI. (2) In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. If return or destruction of PHI is infeasible, Business Associate shall extend the protections of this Agreement to the retained PHI and limit all further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI. VII. HITECH Requirements HITECH imposes additional privacy and security restrictions on Covered Entity and Business Associate in order to enhance the privacy and security of PHI ("HITECH Standards") as required by HIPAA. The Parties hereby acknowledge and agree that, the HITECH Standards set forth in this Section shall be incorporated into this Agreement. The HIPAA privacy and security standards, as set forth in 45 C.F.R. Parts 160, 162 and 164, and remaining terms of this Agreement shall remain in effect to the extent that they are consistent with the following additional requirements: compliance with all Federal and State laws and regulations. Page 5

6 A. Business Associate Compliance with HIPAA Security Standards. Business Associate shall be directly responsible for compliance with the security standards promulgated under HIPAA, as set forth in 45 C.F.R , , , and (the "Security Standards") and, in accordance therewith, adopt, implement, and adhere to security administrative safeguards, physical safeguards, technical safeguards, and security policies, procedures and documentation requirements. Upon request, Business Associate agrees to provide Covered Entity with a copy of its security safeguards, policies and practices. B. Notification of Breach of Unsecured PHI. For purposes of this Agreement, "Unsecured PHI" means any PHI that is not secured through the use of encryption or destruction method(s) that render the PHI unusable, unreadable, or indecipherable to unauthorized individuals through use of a technology or methodology specified by the Secretary. To the extent Business Associate accesses, maintains, retains, modifies, stores, destroys or otherwise holds, uses, or discloses Unsecured PHI, Business Associate shall, following the discovery of a breach of such information, notify Covered Entity without unreasonable delay and in no case later than sixty (60) calendar days after the discovery of said breach, unless a delay of notification is authorized by law enforcement as provided in 42 U.S.C (g). "Breach" shall mean the acquisition, access, use, or disclosure of PHI in a manner not permitted under Subpart E of the Privacy Rule, which compromises the security or privacy of the PHI. Breaches do not include certain inadvertent or unintentional acquisition, access, use, or disclosures as set forth in 42 C.F.R A "breach" shall be treated as discovered by Business Associate as of the first day on which such breach is known to Business Associate (including any person, other than the individual committing the breach, that is an employee, officer, or agent of Business Associate) or should reasonably have been known to Business Associate to have occurred. Upon discovery of an impermissible acquisition, access, use or disclosure of PHI, the Business Associate shall immediately (i) notify Covered Entity, and (ii) engage in a risk assessment to determine if there is a significant risk of harm to the individual(s). Business Associate's notice of a breach shall include the identification of each individual whose Unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, or disclosed during such breach, and shall provide any all available information required by 42 C.F.R (c). Business Associate shall not delay in informing Covered Entity of discovery of a potential breach while Business Associate is in the process of engaging in the risk assessment and preparing the notice. In the event the Unsecured PHI is maintained, used, or disclosed by Business Associate when the breach occurs, Business Associate shall be responsible for any costs incurred by Covered Entity in providing notice to Individuals whose Unsecured PHI was breached. C. Requested Restrictions on Certain Disclosures. In the event an individual requests under 45 C.F.R (a)(1)(i)(A) that Covered Entity restrict the disclosure of the individual's PHI, Business Associate must comply with the requested restriction if (i) except as otherwise Required By Law, the disclosure is to a health plan for purposes of carrying out payment or health care operations (and is not for the purposes of carrying compliance with all Federal and State laws and regulations. Page 6

7 out treatment; and (ii) the PHI pertains solely to a health care item or service for which the health care provider has been paid out of pocket in full. D. Disclosures Limited to Limited Data Set or Minimum Necessary. When using or disclosing PHI or requesting PHI from a covered entity, as permitted or required under this Agreement, Business Associates shall make reasonable efforts to limit such PHI, to the extent practicable, to the limited data set (as defined in 45 C.F.R (e)(2) 1 ) or, if needed by such entity, to the minimum necessary to accomplish the intended purpose of such use, disclosure or request. The "minimum necessary" shall be determined in accordance with 42 U.S.C E. Accounting of Disclosures for Electronic Health Records. To the extent Covered Entity uses or maintains an electronic health record ("EHR") with respect to PHI, then, in response to an individual's request for an accounting of disclosures through said EHR, if Covered Entity elects to provide a list of all business associates acting on behalf of Covered Entity, including contact information for each associate, and in the event Business Associate is included on said list, then, upon receipt of the individual's direct request, Business Associate shall provide an accounting of its disclosures, including those to carry out treatment, payment, and health care operations during the three (3) years prior to the request date. Business Associate shall provide Covered Entity with a copy of any such accounting of disclosures. F. Restriction on Sale of PHI. Business Associate shall not receive remuneration, whether directly or indirectly, in exchange for any PHI of an individual unless Business Associate has obtained a valid authorization that includes a specification of whether the PHI can be further exchanged for remuneration by the entity receiving PHI of said individual, unless the purpose of the exchange is one of the following: (i) public health activities under 45 CFR (b); (ii) research under 45 CFR & (i), provided that the price charged reflects the data preparation and transmittal costs for such purpose; (iii) treatment of the individual, subject to any regulation that the Secretary may promulgate to prevent PHI from inappropriate access, use, or disclosure; (iv) the sale, transfer, merger or consolidation of all or part of the Covered Entity, or an entity that following such activity will become a Covered Entity, and due diligence related to such activity; (v) remuneration provided by Covered Entity to Business Associate in exchange for its performances of Services hereunder; (vi) to provide the individual with a copy of his or her PHI pursuant to 45 CFR ; or (vii) a purpose otherwise determined by the Secretary in regulations to be similarly necessary and appropriate as the exceptions listed herein. 1 A limited data set is protected health information that excludes the following identifiers of the individual or relatives, employers, or household members of the individual: (i) Names; (ii) Postal address information; (iii) Telephone numbers; (iv) Fax numbers; (v) Electronic mail addresses; (vi) Social security numbers; (vii) Medical record numbers; (viii) Health plan beneficiary numbers; (ix) Account numbers; (x) Certificate/license numbers; (xi) Vehicle identifiers and serial numbers, including license plate numbers; (xii) Device identifiers and serial numbers; (xiii) Web Universal Resource Locators (URLs); (xiv) Internet Protocol (IP) address numbers; (xv) Biometric identifier, including finger and voice prints; and (xvi) Full face photographic images and any comparable images). 45 C.F.R (e)(2). compliance with all Federal and State laws and regulations. Page 7

8 VIII. Marketing Communications. A. Any communication by Business Associate about a product or service that encourages recipients of the communication to purchase the product or service ("marketing") may not be treated as "health care operations" for purposes of HIPAA compliance and, therefore, requires the Individual's written authorization, unless the communication is made for one of the following healthcare-related purposes: (1.) To describe a health-related product or service (or payment for such product or service) that is provided by, or included in a plan of benefits of, the covered entity making the communication, including communications about: (i) the entities participating in a health care provider network or health plan network; (ii) replacement of, or enhancements to, a health plan; and (iii) healthrelated products or services available only to a health plan enrollee that add value to, but are not part of, a plan of benefits; (2.) For treatment of the Individual; or (3.) For case management or care coordination for the Individual, or to direct or recommend alternative treatments, therapies, health care providers, or settings of care to the Individual. B. Direct or Indirect Payment Exception. The Individual's written authorization for use and disclosure is also required for any communication made for one of the healthcare-related purposes listed in the above paragraph if Covered Entity receives or has received direct or indirect payment in exchange for making such communication, unless one of the following exceptions applies: (1.) The communication describes only a drug or biologic that is currently being prescribed for the recipient of the communication, and any payment received by Covered Entity is reasonable in amount; (2.) The communication is made by Covered Entity, and Covered Entity obtains a valid authorization, as further defined below, with respect to the communication from the recipient of the communication; or (3.) The communication is made by Business Associate on behalf of Covered Entity, and the communication is consistent with the terms of this Agreement. compliance with all Federal and State laws and regulations. Page 8

9 IX. Indemnification Business Associate shall protect, indemnify and hold harmless Covered Entity, its officers and employees from all claims, suits, actions, attorney s fees, costs, expenses, damages, judgments or decrees arising out of the failure by Business Associate to comply with the requirements of this Agreement or the Privacy Rule; provided however that such indemnification shall be conditioned upon the Covered Entity giving prompt notice of any claims to Business Associate after discovery thereof and cooperating fully with Business Associate concerning the defense and settlement of claims. X. Miscellaneous G. Regulatory References. A reference in this Agreement to a section in the Privacy Rule means the section as in effect or as amended. H. Amendment. The Parties agree to take such action as is necessary to amend this Agreement from time to time as is necessary for the Parties to comply with the privacy obligations under HIPAA and HITECH. This Agreement will be amended only by a written document signed by each party. I. Survival. The respective rights and obligations of Business Associate under Section of this Agreement shall survive the termination of this Agreement. J. Interpretation. Any ambiguity in this Agreement shall be resolved to permit Covered Entity to comply with the Privacy Rule. K. No Third Party Beneficiary Rights. Nothing express or implied in this Agreement is intended or shall be interpreted to create or confer any rights, remedies, obligations or liabilities whatsoever in any third party. L. Notice. Any notice permitted or required by this Agreement will be considered made on the date personally delivered in writing or mailed by certified mail, postage prepaid, to the other party at the address set forth on the signature page of this Agreement or to such other person or address as either party may designate in writing. M. Waiver. The waiver by Business Associate or Covered Entity of a breach of this Agreement will not operate as a waiver of any subsequent breach. No delay in acting with regard to any breach of this Agreement will be construed to be a waiver of the breach. N. Assignment. This Agreement will not be assigned by either party without prior written consent of the other party. This Agreement will be for the benefit of, and binding upon, the parties hereto and their respective successors and permitted assigns. O. Governing Law. The interpretation and enforcement of this Agreement will be governed by the laws of the State of South Carolina. compliance with all Federal and State laws and regulations. Page 9

10 P. Headings. The section headings contained in this Agreement are for reference purposes only and will not affect the meaning of this Agreement. Q. Counterparts. This Agreement may be executed in counterparts, each of which will be deemed to be an original, but all of which together will constitute one and the same. IN WITNESS WHEREOF, the parties have duly executed this agreement as of the date set forth below. Company Name Company Address Company Name Company Address By: Signature: Title: Date: By: Signature: Title: Date: compliance with all Federal and State laws and regulations. Page 10