Extracted text (via pymupdf_layout)
30067 characters
Maricopa County Special Health Care District d.b.a. Maricopa Integrated Health System 2611 East Pierce Street Phoenix, AZ 85008-6092 602.344.1497 602.344.1813 (Fax) BUSINESS ASSOCIATE AGREEMENT This Agreement sets out the responsibilities and obligations of ____________________________________________________________ (“Business Associate” or “Associate”) as a business associate of the Maricopa County Special Health Care District, d.b.a. Maricopa Integrated Health System (“MIHS”), a covered entity, under the Health Insurance Portability and Accountability Act (“HIPAA”), the Health Information Technology for Economic and Clinical Health (“HITECH”) Act, and pursuant to the Contract or Engagement Letter between Associate and MIHS. MIHS may make available and/or transfer to Associate Protected Health Information (“PHI”) of individuals in conjunction with Services, which Associate will use or disclose only in accordance with this Agreement. Associate and MIHS agree to the terms and conditions of this Agreement in order to comply with the use and handling of PHI under the HIPAA Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. Part 160 and Part 164, Subpart E (“Privacy Standards”) and the HIPAA Security Standards, 45 C.F.R. Part 160 and Part 164, Subpart C (“Security Standards”), both as amended from time to time. Unless otherwise provided, all capitalized terms in this Agreement will have the same meaning as provided under the Privacy Standards and Security Standards. Associate and MIHS will comply with the terms of this Agreement for the duration of the Contract or Engagement Letter and for such other continuing periods as provided in this Agreement. Upon the compliance date of any final regulation or amendment to final regulation promulgated by the Secretary of Health and Human Services that affects Associate’s use or disclosure of PHI, the parties agree to take such reasonable action as is necessary to amend this Agreement in order for MIHS to comply with such final regulation or amendment to final regulation. Definitions for terms in this Agreement: 1. Business Associate or Associate means an entity that creates, receives, maintains or transmits PHI for a function or activity on behalf of a Covered Entity, regulated by Subchapter C of Title 45 of the Code of Federal Regulations. In addition, an Associate can be an entity that provides data transmission services to a Covered Entity, is more than a mere conduit of information, and allows a Covered Entity to access the maintained information in a manner beyond a random or infrequent basis. The terms “Business Associate”, “Associate” and “Contractor” are synonymous. Notwithstanding this definition, if Contractor does not have access to or create Protected Health Information under this Contract, Contractor is not an Associate, and the terms of this Agreement do not apply to Contractor. 2. Contractors of Business Associate means a person or an entity to whom an Associate delegates a function, activity, or service that the Associate has agreed to perform for a Covered Entity. A contractor of an Associate which creates, receives, maintains, or transmits personal health information on behalf of the business associate is itself a Business Associate and therefore will comply with the terms of this Agreement. For purposes of this Agreement the term “Contractor” includes the Contractor, its employees, its subcontractors and its agents. MIHS Business Associate Agreement 1 Revised 1/3/2016 3. Protected Health Information (“PHI”) means the health information that is created or received by a Covered Entity; and relates to the physical condition, mental health or other health condition of an Individual, or to the provision of health care to the Individual (including but not limited to the payment for such health care); and identifies or can be used to identify the Individual as defined in 45 C.F.R. § 160.103. 4. Individual shall have the meaning set forth in 45 CFR §160.103, including a person who is the subject of the Protected Health Information, and shall include an individual or entity who qualifies as a personal, legal representative of the person, as the context requires. 5. Privacy Rule shall mean the Standards for Privacy of Individually Identifiable Health Information at 45 CFR Parts 160 and 164, Subparts A and E, as may be amended, modified or superseded, from time to time. 6. Security Rule shall mean the Standards for Security of Individually Identifiable Electronic Health Information at 45 CFR Parts 160 and 164, Subparts A, C and E, as may be amended, modified or superseded, from time to time. 7. Breach shall mean the acquisition, access, use or disclosure of Protected Health Information in a manner not permitted by the HIPAA Privacy Rule, that compromises the security or privacy of the Protected Health Information as defined, and subject to the exception given to such term in 45 C.F.R. § 164.402. 8. Breach Notification Rule shall mean the interim final rule related to breach notification for unsecured protected health information at 45 C.F.R. Parts 160 and 164. 9. Covered Entity shall have the meaning given to such term in 45 C.F.R. § 160.103. 10. Designated Record Set shall have the meaning given to such term under the Privacy Rule at 45 C.F.R. § 164.501. 11. Security Incident shall have the meaning given to such phrase under the Security Rule at 45 C.F.R. § 164.304. 12. Unsecured PHI shall have the meaning given to such phrase under the Breach Notification Rule at 45 C.F.R. § 164.402. 13. Electronic Protected Health Information or ePHI shall have the same meaning given to such term under the Security Rule, including, but not limited to, 45 C.F.R. § 160.103. 14. Electronic Media shall have the same meaning given to such term in 45 C.F.R. § 160.103. 15. Health Information Technology for Economic and Clinical Health (HITECH) Act, as codified at 42 U.S.C. §§ 17921-17954. 16. Secretary shall mean the Secretary of the Department of Health and Human Services or his or her designee. It is agreed by and between the parties that: 1. Uses and Disclosures of Protected Health Information. Associate will use and disclose PHI only for those purposes necessary to perform its duties, obligations and functions under the Contract, or as otherwise expressly permitted in this Agreement or as required by other law. a. Associate will not use or further disclose any PHI in violation of this Agreement. b. Associate may use PHI to perform data aggregation services as permitted by 45 C.F. R. § 164.504(e) (2) (i) (B). c. Associate agrees that anytime it provides PHI received from MIHS to a Contractor, its employees, subcontractor, or agent to perform Services for MIHS, Associate first will enter into a contract with such Contractor, employees, subcontractor or agent that contains the same terms, conditions, and restrictions on the use and disclosure of PHI as contained in this Agreement. MIHS Business Associate Agreement 2 Revised 1/3/2016 d. If Associate maintains a Designated Record Set, MIHS will provide Associate with copies of applicable policies and procedures, which the Associate will comply with as related to an individual’s right to access PHI; request an amendment to PHI; request confidential communications of PHI; or request an accounting of disclosures of PHI. 2. Associate Use or Disclosure of Protected Health Information for its Own Purposes. Associate may use or disclose PHI received from MIHS for Associate’s management and administration, or to carry out Associate’s legal and contractual responsibilities. Associate may disclose PHI received from MIHS to a third party for such purposes only if: a. The disclosure is required by law; or b. Associate secures written assurance from the receiving party that the receiving party will: (i) hold the PHI confidentially; (ii) use or disclose the PHI only as required by law or for the purposes for which it was disclosed to the recipient; and (iii) notify the Associate of any breaches in the confidentiality of the PHI. c. Associate may use and disclose de-identified health information, if (i) the use is disclosed to MIHS and permitted by MIHS in its sole discretion, (ii) that the de-identification is in compliance with 45 C.F.R. § 164.502(d), and (iii) the de-identified health information meets the standard and implementation specifications for de-identification under 45 C.F.R. § 164.514(a) and (b). d. Associate shall use and disclose PHI only to the extent reasonably necessary to accomplish the intended purpose of such PHI. 3. Safeguards. Associate will implement and maintain appropriate safeguards to prevent any use or disclosure of PHI not otherwise permitted in this Agreement. a. Associate also will implement administrative, physical and technical safeguards to protect the confidentiality, integrity, and availability of any electronic protected health information (“e-PHI”), if any, that Associate creates, receives, maintains, and transmits on behalf of MIHS. b. Upon request of MIHS, Associate will provide evidence to MIHS that these safeguards are in place and are properly managed. 4. Reports of Improper Use or Disclosure of Secure or Unsecure Protected Health Information and of Security Incidents and Breaches. Associate will report in writing to MIHS any use or disclosure of PHI, including any breach, not permitted by the contract between Associate and MIHS within five (5) days of Associate’s learning of such use, disclosure or breach or within five (5) days following the exercise of reasonable diligence would have known of the improper use, disclosure, or breach. 5. Mitigation of potential harmful effects. Associate shall mitigate all potential harmful effects of a use or disclosure of Protected Health Information by Business Associate in violation of the requirements of this Agreement. Immediately following the Associate’s discovery of a Breach (or upon the Associate’s reasonable belief that a Breach has occurred), Associate shall provide MIHS with sufficient information to permit MIHS to comply with the Breach notification requirements set forth at 45 C.F.R. §164.400 et seq. a. Specifically, if the following information is known to (or can be reasonably obtained by) the Associate, Associate will provide to MIHS all available information that MIHS is required to include in its notification to the individual pursuant to the Breach Notification Rule, including but not limited to: i. contact information for individuals who were or who may have been impacted by the Breach (e.g., first and last name, mailing address, street address, phone number, email address); ii. a brief description of the circumstances of the Breach, including the date of the Breach, the date of discovery of the Breach, and the identity of who accessed and received the Unsecured PHI; iii. a description of the types of unsecured PHI involved in the Breach (e.g., names, social security number, date of birth, address(s), account numbers of any type, disability codes, diagnostic and/or billing codes and similar information); MIHS Business Associate Agreement 3 Revised 1/3/2016 iv. a brief description of what the Associate has done or is doing to investigate the Breach, mitigate harm to the individual impacted by the Breach, and protect against future Breaches; and v. contact information for a liaison appointed by the Associate with whom MIHS may ask questions and learn additional information concerning the Breach. b. Following a Breach, Associate will have a continuing duty to inform MIHS of new information learned by Associate regarding the Breach, including but not limited to the information described in items (1) through (5), above. c. Associate also will report in writing to MIHS any Security Incident (successful or unsuccessful) of which Associate becomes aware within five (5) business days of Associate learning of such use or disclosure. Specifically, Associate will report to MIHS any unauthorized access, use, disclosure, modification, or destruction of e-PHI or interference with system operations in an information system containing e-PHI of which Associate becomes aware, provided that: i. such reports will be provided only as frequently as the parties mutually agree, but no more than once per month; and ii. if the definition of “Security Incident” under the Security Standards is amended to remove the requirement for reporting “unsuccessful” attempts to use, disclose, modify or destroy e-PHI, the portion of this Section 5 addressing the reporting of unsuccessful, unauthorized attempts will no longer apply as of the effective date of such amendment. 6. Obligations Regarding Associate Personnel. Associate will appropriately inform all of its employees, agents, representatives, members of its workforce, and Contractors, its employees, subcontractors, or agents of Associate (“Associate Personnel”), whose services may be used to satisfy Associate’s obligations under the Contract and this Agreement of the terms of this Agreement. Associate represents and warrants that the Associate Personnel are under legal obligation to Associate, by contract or otherwise, sufficient to enable Associate to fully comply with the provisions of this Agreement. Associate will maintain a system of sanction for any Associate Personnel who violates this Agreement. 7. Access to Protected Health Information. a. MIHS Access. Within five (5) business days of a request by MIHS for access to PHI received from MIHS, Associate will make requested PHI available to MIHS. b. Patient Access. If a Patient requests access to PHI directly from Associate, Associate will within five (5) business days forward such request in writing to MIHS. MIHS will be responsible for making all determinations regarding the grant or denial of a Patient’s request for PHI and Associate will make no such determinations. Only MIHS will release PHI to the Patient pursuant to such a request. 8. Amendment of Protected Health Information. a. MIHS Request. Within five (5) business days of receiving a request from MIHS to amend an individual’s PHI received from MIHS, Associate will provide such information to MIHS for amendment. Alternatively, if MIHS request includes specific information to be included in the PHI as an amendment, Associate will incorporate such amendment within five (5) business days of receipt of the MIHS request. b. Individual Request. If an individual makes a request for amendment directly to Associate, Associate will forward within five business days such request in writing to MIHS. MIHS will be responsible for making all determinations regarding amendments to PHI and Associate will make no such determinations. 9. Accounting of Disclosures; Requests for Disclosure. a. Disclosure Records. Associate will keep a record of any disclosure of PHI received from MIHS that Associate makes to its employees, subcontractors, and agents, or other third parties other than: (1) Disclosures to health care providers to assist in the treatment of patients; MIHS Business Associate Agreement 4 Revised 1/3/2016 (2) Disclosures to others to assist MIHS in paying claims; (3) Disclosures to others to assist MIHS in conducting its health care operations, as defined in 45 C.F.R. § 164.501; or (4) Disclosures made pursuant to an individual’s Authorization. Associate will maintain this disclosure record for six (6) years from the termination of this Agreement. Associate also agrees to maintain necessary and sufficient documentation of Disclosures of Protected Health Information as would be required for MIHS to respond to a request by an individual for an accounting of Disclosures, in accordance with 45 CFR 164.528. b. Data Regarding Disclosures. For each disclosure for which it is required to keep a record under paragraph 8(a), Associate will record and maintain the following information: (1) The date of disclosure; (2) The name of the entity or person who received the PHI, and, the address of such entity or person, if known. (3) A description of the PHI disclosed; and (4) A brief statement of the purpose of the disclosure. c. Provision to MIHS. Associate will provide to MIHS its record of disclosures under paragraph 8(a), if any, within thirty days of each disclosure. Within five business days of receiving a notice from MIHS of an individual’s request for an accounting, Associate also will provide to MIHS its disclosure record. d. Patient Request to Associate. If a Patient requests and accounting of disclosures directly from Associate, Associate will forward the request to MIHS within five (5) business days of Associate’s receipt of the request, and will make its records of disclosures available to MIHS as otherwise provided in this Section. MIHS will be responsible to prepare and for delivery of the records of disclosure to the Patient. Associate will not provide an accounting of its disclosure directly to the Individual. 10.Notice of Privacy Practices. MIHS shall provide Associate a copy of its Notice of Privacy Practices (“Notice”) in accordance with 45 C.F.R. § 164.520 as well as any changes to the Notice. If MIHS’ Notice specifically affects Associate’s use or disclosure of PHI, MIHS shall inform Associate of the specific limitations. Associate shall abide by the limitations of MIHS’ Notice that affects its use or disclosure of PHI of which it has been specifically informed. Any use or disclosure permitted by this Agreement may be amended by changes to MIHS’ Notice if MIHS specifically informs Associate of the amendment: provided, however, that the amended Notice shall not affect permitted uses and disclosures on which Associate relied prior to receiving notice of such amended Notice. 11.Access to Books and Records. a. MIHS Access. Associate will, within fifteen (15) business days of MIHS written request, make available during normal business hours at Associate’s offices, all records, books, agreements, policies and procedures relating to the use or disclosure of PHI received from MIHS for the purpose of allowing MIHS or its agents or auditors to determine Associate’s compliance with this Agreement. b. Government Access. Associate will make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Associate on behalf of, MIHS available to the Secretary of the Department of Health and Human Services to the extent required for determining compliance with the Privacy Standards. Notwithstanding this provision, no attorney-client, accountant- client or other legal privilege will be deemed waived by Associate or MIHS as a result of this Section. 12.Termination. MIHS may immediately terminate the Contract, if any and this Agreement upon written notice to Associate if MIHS determines that the Associate or subcontractor(s) or agent(s) of Associate has breached a material term of this Agreement. Alternatively, MIHS may elect to provide Associate with written notice of MIHS Business Associate Agreement 5 Revised 1/3/2016 Associate’s or subcontractor(s)’ or agent(s)’ of Associate breach of any term or condition of this Agreement and afford Associate the opportunity to cure the breach to the satisfaction of MIHS within thirty (30) days of the date of such notice. If Associate fails to timely cure the breach, as determined by MIHS at its sole discretion, MIHS may terminate the Contract and this Agreement. 13.Return or Destruction of Protect Health Information. a. Return of PHI; Destruction. Within thirty (30) days of termination of the Contract or this Agreement, Associate will return to MIHS all PHI received from MIHS or created or received by Associate on behalf of MIHS that Associate maintains in any form or format. Associate will not maintain or keep in any form or format any portion of such PHI. Alternatively, Associate may, upon MIHS written consent, destroy all such PHI and provide written documentation of such destruction. The requirement to return or destroy such PHI will apply to all agents or subcontractors of Associate. Associate will be responsible for recovering any PHI from such agents or subcontractors. If Associate cannot obtain the PHI from any agent or subcontractor, Associate will so notify MIHS and will require that such agents or subcontractors directly return PHI to MIHS or otherwise destroy such PHI, subject to the terms of this Section. b. Alternative Measures. If Associate believes that returning or destroying PHI at the termination of the Contract or this Agreement is infeasible, it will provide written notice to MIHS within five (5) business days of the effective date of termination of this Agreement. Such notice will set forth the circumstances that Associate believes makes the return or destruction of PHI infeasible and the alternative measures that Associate recommends for assuring the continued confidentiality and security of the PHI. MIHS promptly will notify Associate of whether it agrees that the return or destruction of PHI is infeasible. If MIHS agrees that return or destruction of PHI is infeasible, Associate agrees to extend all protections, limitations and restrictions of this Agreement to Associate’s use or disclosure of PHI retained after termination of this Agreement and to limit further uses or disclosures to those purposes that make the return or destruction of the PHI infeasible. Any such extended protections, limitations and restrictions will apply to any agents or subcontractors of Associate for whom return or destruction of PHI is determined by MIHS to be infeasible. If MIHS does not agree that the return or destruction of PHI from Associate or its agents or subcontractors is infeasible, MIHS will provide Associate with written notice of its decision, and Associate, its agents and subcontractors will proceed with the return or destruction of the PHI pursuant to the terms of this Section within fifteen (15) days of the date of MIHS notice. 14.Restrictions on Use or Disclosure of Protected Health Information. If MIHS advises Associate of any changes in, or restrictions to, the permitted use or disclosure of PHI received from MIHS, Associate will restrict the use or disclosure of such PHI consistent with the MIHS instructions. 15.Mitigation Procedures. Associate agrees to have procedures in place for mitigating, to the maximum extent practicable, any deleterious effect from the use or disclosure of PHI received from MIHS in a manner contrary to this Agreement or the Privacy Standards. 16.Compliance with the HITECH Act. Associate will comply with the requirements of Title XII, Subtitle D of the Health Information Technology for Economic and Clinical Health (HITECH) Act, codified at 42 U.S.C. §§ 17921- 17954, which are applicable to Associates, and will comply with all regulations issued by the Department of Health and Human Services (HHS) to implement these referenced statutes, as of the date by which Associates are required to comply with such referenced statutes and HHS regulations. a. Associate will also comply with Section 13402 of the HITECH Act, codified at 42 U.S.C. § 17932, and with all regulations issued by HHS to implement this statute, as of the date by which Associates are required to comply with such referenced statutes and HHS regulations. Associate will make a report to the MIHS of any breach of unsecured protected health information, as required by 42 U.S.C. § 17932(b), within five (5) business days of Associate’s discovery of the breach. Associate will indemnify MIHS for any reasonable expenses MIHS incurs in notifying individuals of a breach caused by Associate or its subcontractors or agents. 17.Miscellaneous. MIHS Business Associate Agreement 6 Revised 1/3/2016 a. Compliance with Laws. The Parties acknowledge that state and federal laws relating to electronic data security and privacy are rapidly evolving and that amendment of this Agreement may be required to ensure compliance with such developments. Should such developments occur, and upon either Party’s good faith request, the other Party agrees to enter good faith negotiations concerning the terms of an amendment to this Agreement. b. Construction of Terms. The terms of this Agreement will be construed in light of any applicable interpretation or guidance on the Privacy Standards and Security Standards issued by the Department of Health and Human Services and other applicable state or federal laws, rules and regulations as amended from time to time. c. No Third Party Beneficiaries. Nothing in this Agreement will confer upon any person other than the parties and their respective successors or assigns, any rights, remedies, obligations, or liabilities, whatsoever. d. Assignment of Rights and Delegation of Duties. This Agreement is binding upon and inures to the benefit of the Parties hereto and their respective successors and permitted assigns. However, neither Party may assign any of its rights or delegate any of its obligations under this Agreement without prior written consent of the other Party, which consent shall not be unreasonable withheld or delayed. Notwithstanding any provisions to the contrary, however, MIHS retains the right to assign or delegate any of its rights and obligations hereunder to any of its wholly owned subsidiaries, affiliates or successor companies. Assignments made in violation of this provision are null and void. e. No Waiver. Failure or delay on the part of either Party to exercise any right, power, privilege or remedy hereunder shall not constitute a waiver thereof. No provision of this Agreement may be waiver by either Party except by a writing signed by an authorized representative of the Party making the waiver. f. Severability. The provisions of this Agreement shall be severable, and if any provision of this Agreement shall be held or declared to be illegal, invalid or unenforceable, the remainder of this Agreement shall continue in full force and effect as though such illegal, invalid or unenforceable provision had not been contained herein. g. Entire Agreement. This Agreement constitutes the entire agreement between the parties with regard to the Privacy Standards and Security Standards, there are no understandings or agreements relating to this Agreement that are not fully expressed in this Agreement and no change, waiver or discharge of obligations arising under this Agreement will be valid unless in writing and executed by the party against whom such change, waiver or discharge is sought to be enforced. h. Written Agreement. This Agreement is considered as an integral part of the underlying Contract, and is incorporated as though fully set forth within the Contract. This Agreement will govern in the event of conflict or inconsistency with any provision of Contract. i. Choice of Law. This Agreement and the rights and obligations of the parties hereunder shall be governed by and construed under the laws of the State of Arizona, without regard to applicable conflict of law principles. j. Counterparts. This Agreement may be executed in two or more counterparts, each of which shall be deemed an original and when taken together shall constitute one agreement. k. Facsimile and Electronic Signatures. Facsimile and electronic signatures shall be deemed to be original signatures for all purposes of this Agreement. l. Notices. Any notices required under this Agreement will be sent to the parties at the following address by first class mail, fax or hand delivery: MIHS Business Associate Agreement 7 Revised 1/3/2016 MIHS COMPLIANCE/PRIVACY OFFICER BUSINESS ASSOCIATE (‘Associate’) Maricopa Integrated Health System ______________________________ 2601 East Roosevelt Street ______________________________ Phoenix, AZ 85008 ______________________________ FAX 602.344.5190 ______________________________ Agreed to by MIHS and Associate by: MIHS ASSOCIATE _____________________________________ _________________________________ SIGNATURE DATE SIGNATURE DATE PRINT NAME AND TITLE PRINT NAME AND TITLE MIHS Business Associate Agreement 8 Revised 1/3/2016 Maricopa Integrated Health System 2611 East Pierce Street Phoenix, AZ 85008-6092 602.344.1497 602.344.1813 (Fax) BUSINESS ASSOCIATE AGREEMENT FOR RELEASE OF INFORMATION TO THIRD PARTIES 1. _______________________________ (“Associate”) is a business associate of Maricopa County Special Health Care District, d.b.a. Maricopa Integrated Health System (MIHS) pursuant to the Agreement between Associate and MIHS dated __________ (“Agreement”). Pursuant to that Agreement, Associate is required to comply with the requirements for the use and handling of Protected Health Information (“PHI”) from MIHS as set forth in the Standards for Privacy of Individually Identifiable Health Information, 45 C.F.R. 164.501 et. seq. as amended from time to time (“Privacy Standards”). 2. Associate is permitted to disclose PHI to _______________ (“Recipient”) for the necessary management and administration of Associate and to carry out the legal responsibilities of the Associate, provided that Recipient provides Associate with the following assurances for Recipient’s use and disclosure of PHI. 3. Associate seeks to disclose PHI to Recipient for the following management, administration or legal responsibilities of Associate: 4. The disclosure of PHI to Recipient is conditioned upon Recipient’s assurance that, and Recipient agrees that it will: a. Hold the PHI confidentially and make no re-disclosure to any third party without Associate’s express advance written consent; b. Use or disclose the PHI only as required by law or for the purposes set forth above; and c. Notify Associate in writing of any breaches in the confidentiality of the PHI within three days of discovery of any such breach. ASSOCIATE RECIPIENT _____________________________________ _______________________________ SIGNATURE DATE SIGNATURE DATE _____________________________________ ________________________________ PRINT NAME AND TITLE. PRINT NAME AND TITLE MIHS Business Associate Agreement 9 Revised 1/3/2016