BUSINESS ASSOCIATE AGREEMENT RE HITECH AND HIPAA WITH NAVICURE.PDF

Docu Sign Envelope ID: FE1E5872-91AD-409F-B8F1-99EF28EE9108
IARICOPA COUNTY HEALTH CARE BUSINESS ASSOCIATE AGREEMENT
UPDATED FOR HITECH AND THE HIPAA OMNIBUS RULE
For purposes of this Business Associate Agreement (Agreement), the Customer is referred to as "Covered Entity" and Navicure
as "Business Associate." Business Associate hereby acknowledges and agrees that Covered Entity is a covered entity and that
Business Associate is a business associate under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA") and HIPAA
Rules.
Covered Entity wishes to disclose certain information to Business Associate, some of which may constitute Protected Health
Information. Navicure and Customer are both committed to complying with (a) HIPAA, (b) the HIPAA Rules and (c) applicable state
law, as these statutes and regulations may be amended from time to time. This Agreement sets forth the terms and conditions pursuant
to which Protected Health Information will be handled by Business Associate during the term of the Agreement.
Navictire and Customer agree as follows:
1. DEFINITIONS
1.1. The following capitalized terms used in this Agreement shall have the meanings established for purposes of the HIPAA Rules, as
amended from time to time: Breach, Data Aggregation, Designated Record Set, Health Care Operations, Individual, Minimum
Necessary, Required by Law, Security Incident, Subcontractor and Unsecured Protected Health Information,
1.2, "Business Associate" shall generally have the same meaning as the term "business associate' at 45 CFR 160.103 and, in
reference to a party to this Agreement, shall mean Navicure,
1.3. "Covered Entity" shall generally have the same meaning as the term "covered entity" at 45 CFR 160.103 and, in reference to a
party to this Agreement, shall mean Customer,
1.4. "HIPAA Rules" shall mean the Privacy, Security, Breach Notification and Enforcement Rules at 45 CFR Part 160 and Part 164, as
amended from time to time.
1.5, "Protected Health Information" shall mean Protected Health Information, as defined in 45 C,F,R. § 160.103, and is limited to the
Protected Health Information received from, or received or created on behalf of Covered Entity by Business Associate pursuant to
performance of the Services.
2. PERMITTED USES AND DISCLOSURES OF PROTECTED HEALTH INFORMATION
2.1. Services. Business Associate provides services (which may include transaction services, clearinghouse services and servicing
hardware or software products) ("Services") that involve the use and/or disclosure of Protected Health Information pursuant to a written
license agreement with Covered Entity ("License Agreement") that specify the Services to be provided to Covered Entity. Except as
otherwise specified herein, Business Associate may make any and all uses and disclosures of Protected Health Information created or
received from or on behalf of Covered Entity necessary to perform its obligations under the License Agreement or as may be Required
by Law. Business Associate may perform Data Aggregation for, and related to the Health Care Operations of, the Covered Entity.
2.2. Business Activities of the Business Associate. Unless otherwise limited herein, the Business Associate may: (a) consistent
with and subject to the limitations and requirements of the HIPAA Rules, use and disclose the Protected Health Information in its
possession for its proper management and administration and to fulfill any present or future legal responsibilities of the Business
Associate; and (b) de-identify any and all Protected Health Information in accordance with the HIPAA Rules. Covered Entity
acknowledges and agrees that de-identified information is not Protected Health Information and that Business Associate may use such
de-identified information for any lawful purpose.
3. RESPONSIBILITIES OF THE PARTIES
3.1. Responsibilities of the Business Associate with Respect to Protected Health Information. With regard to its use and/or
disclosure of Protected Health Information, Business Associate agrees to:
(a) use and/or disclose Protected Health Information only as necessary to provide the Services, as permitted or required by this
Agreement, or as otherwise Required by Law;
(b) implement and use appropriate safeguards to: (i) prevent use or disclosure of Protected Health Information other than as
permitted or required by this Agreement: and (ii) protect the Electronic Protected Health Information that Business Associate creates,
receives, maintains, or transmits on behalf of the Covered Entity as provided in Subpart C of 45 CFR Part 164;
(0) without unreasonable delay, and in any event on or before 48 hours after its discovery by Business Associate, report to
Covered Entity: (i) any use or disclosure of Protected Health Information not provided for by this Agreement of which it becomes
aware, including Breaches of Unsecured Protected Health Information as required at 45 CFR 164.410; and/or (ii) any Security Incident
of which Business Associate becomes;
(d) without unreasonable delay, and in any event on or before 48 hours after its Discovery by Business Associate, notify
Covered Entity of any Breach or any other incident that involves an unauthorized acquisition, access, use, or disclosure of Protected
Health Information, even if Business Associate believes the incident will not rise to the level of a Breach. The notification shall include,
to the extent possible, and shall be supplemented on an ongoing basis with: (1) the identification of all individuals whose Unsecured
Protected Health Information was or is believed to have been involved, (ii) all other information reasonably requested by Covered Entity
to enable Covered Entity to perform and document a risk assessment with respect to the incident, and (iii) all other information
reasonably necessary to provide notice to individuals, HHS and/or the media. Notwithstanding the foregoing, in Covered Entity's sole
discretion and in accordance with its directions, Business Associate shall conduct, or pay the costs of conducting, an investigation of
any incident required to be reported under this subsection (d) and shall provide, and/or pay the costs of providing, the required notices
as set forth in this subsection (d);
Page 1 uf 3 Revised 7/7113

Docu Sign Envelope ID: FE1E5872-91AD-409F-B8F1-99EF28EE9108
(e) mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of Protected
Health information by Business Associate not provided for by this Agreement;
(f) require all of its Subcontractors and agents that create, receive, maintain, or transmit Protected Health Information to agree,
in writing, to the same restrictions and conditions on the use and/or disclosure of Protected Health Information that apply to Business
Associate; including but not limited to the extent that Business Associate provides Electronic Protected Health Information to a
Subcontractor or agent, it shall require the Subcontractor or agent to implement reasonable and appropriate safeguards to protect the
Electronic Protected Health Information consistent with the requirements of this Agreement;
(g) make available its internal practices, books and records relating to the use and disclosure of Protected Health Information to
the Secretary of HHS for purposes of determining compliance with the HIPAA Rules;
(h) document, and within thirty (30) days after receiving a written request from Covered Entity, make available to Covered Entity
information necessary for Covered Entity to make an accounting of disclosures of Protected Health Information about an Individual or,
when and as directed by Covered Entity, make that information available directly to an Individual, all in accordance with the HIPAA
Rules and in accordance with the requirements for accounting for disclosures made through an Electronic Health Record;
(I) provide access to Covered Entity, within fifteen (15) days after receiving a written request from Covered Entity, to Protected
Health Information in a Designated Record Set about an Individual, or when and as directed by Covered Entity, provide that access
directly to an Individual;
(j) notwithstanding subsection (i) above, in the event that Business Associate in connection with the Services uses or maintains
an Electronic Health Record of Protected Health information of Of about an Individual, then Business Associate shall provide an
electronic copy (at the request of Covered Entity, and in the reasonable time and manner requested by Covered Entity) of the Protected
Health Information, to Covered Entity or, when and as directed by Covered Entity, directly to an Individual or a third party designated by
the individual;
(k) to the extent that the Protected Health Information in Business Associate's possession constitutes a Designated Record Set,
make available, within thirty (30) days after a written request by Covered Entity, Protected Health Information for amendment and
incorporate any amendments to the Protected Health Information as directed by Covered Entity;
(I) notify Covered Entity in writing within three (3) days after its receipt directly from an Individual of any request for an
accounting of disclosures, access to, or amendment of Protected Health Information as contemplated in subsections (j)-(k);
(m) request, use and/or disclose only the Minimum Necessary Protected Health Information to accomplish the purpose of the
request, use or disclosure;
(n) not directly or indirectly receive remuneration in exchange for any Protected Health Information;
(o) not make or cause to be made any communication about a product or service that is prohibited by the HIPAA Rules; and
(p) not make or cause to be made any written fundraising communication that is prohibited by the HIPAA Rules.
3.2. Responsibilities of the Covered Entity with Respect to Protected Health Information. (a) With regard to the use and/or
disclosure of Protected Health Information by the Business Associate, the Covered Entity agrees: (i) to obtain any consent, authorization
or permission that may be required by the HIPAA Rules or any other applicable federal, state or local laws and/or regulations prior to
furnishing Business Associate the Protected Health Information pertaining to an Individual; and (ii) that it will not furnish Business
Associate Protected Health Information that is subject to any arrangements permitted or required of the Covered Entity, unless it has
provided Business Associate with written notification of any such arrangement, including but not limited to, arrangements agreed to by
Covered Entity that may impact in any manner the use and/or disclosure of Protected Health Information by the Business Associate
under this Agreement and the License Agreement. (b) Covered Entity represents and warrants that its notice of privacy practices
permits Covered Entity to use and disclose Protected Health Information in the manner that Business Associate is authorized to use
and disclose Protected Health Information under this Agreement.
3.3. Indemnification, Business Associate shall indemnify Covered Entity against all claims or liabilities, including reasonable
attorneys' fees, arising out of Business Associate's breach of this Agreement.
4. TERM AND TERMINATION
4.1. Term. Each term and condition of this Agreement shall become effective on the Effective Date. This Agreement shall continue in
effect unless terminated as provided in this Section 4, provided, that certain provisions and requirements of this Agreement shall survive
the expiration or termination of this Agreement in accordance with Section 5.4 herein.
4.2. Termination. If either Party knows of a pattern of activity or practice of the other Party that constitutes a material breach or
violation of this Agreement then the non-breaching Party shall provide written notice of the breach or violation to the other Party that
specifies the nature of the breach or violation. The breaching Party must cure the breach or end the violation on or before thirty (30)
days after receipt of the written notice. In the absence of a cure reasonably satisfactory to the non-breaching Party within the specified
time frame, or in the event the breach is reasonably incapable of cure, then the non-breaching Party may, if feasible, terminate this
Agreement and the underlying License Agreement.
4,3, Automatic Termination. This Agreement will automatically terminate without any further action of the Parties upon the
termination or expiration of the License Agreement between Covered Entity and Business Associate.
4.4, Effect of Termination. Upon termination of this Agreement for any reason, Business Associate, with respect to Protected
Health Information received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered
Entity, shall; (i) retain only that Protected Health Information which is necessary for Business Associate to continue its proper
management and administration or to carry out its legal responsibilities; (ii) return to Covered Entity, or destroy, the remaining Protected
Health Information that the Business Associate still maintains in any form; (iii) continue to use appropriate safeguards and comply with
Subpart C of 45 CFR Part 164 with respect to Electronic Protected Health Information to prevent use or disclosure of the Protected
Health Information, other than as provided for in this Section, for as long as Business Associate retains the Protected Health
Information; (iv) not use or disclose the Protected Health Information retained by Business Associate other than for the purposes for
which such protected health information was retained and subject to the same conditions set out in this Agreement which applied prior
to termination; and (v) return to Covered Entity, or destroy, the Protected Health Information retained by Business Associate when it is
no longer needed by Business Associate for its proper management and administration or to carry out its legal responsibilities.
Page 2 of 3 ReviseKt 7i1/13

DocuSign Envulope ID: FE1E5872-91AD-409F-B8F1-99EF28EE9108
5. MISCELLANEOUS
5.1. Change of Law. Covered Entity shall notify Business Associate within ninety (90) days of any amendment to any provision of
HIPAA or the HIPAA Rules, or other applicable law, which materially alters either party's or the parties' obligations under this
Agreement. The parties agree to negotiate in good faith mutually acceptable and appropriate amendment(s) to this Agreement to give
effect to such revised obligations: provided however, that if the parties are unable to agree on mutually acceptable amendment(s)
within ninety (90) days of the relevant change of law, either party may terminate this Agreement consistent with sections 4.2 and 4.4,
5.2. Construction of Terms. The terms of this Agreement to the extent they are unclear, shall be construed to allow for
compliance by Covered Entity with the HIPAA Rules. A reference in this Agreement to a section in the HPAA Rules means the section
as in effect or as amended.
5.3. Limitation of Liability. Notwithstanding any provision of this Agreement to the contrary, the parties agree and acknowledge
that this Agreement, and any damages incurred by either party hereunder, are subject to the limitation of liability provisions contained in
the underlying License Agreement, as such License Agreement may be amended pursuant to its terms.
5,4, Survival. Sections 1, 2, 4.4, 5,3, and this Section 5,4, and any other provisions of this Agreement that by their terms are
intended to survive, shall survive the termination of this Agreement,
5.5. Amendment; Entire Agreement; Waiver. This Agreement may not be modified, nor shall any provision hereof be waived or
amended, except in a writing duly signed by authorized representatives of the Parties. This Agreement constitutes the entire
agreement between the parties with respect to the matters contemplated herein and supersedes all previous and contemporaneous
oral and written negotiations, commitments, and understandings relating thereto, together with all previous business associate
agreement(s) and/or amendments thereto. A waiver with respect to one event shall not be construed as continuing, or as a bar to or
waiver of any right or remedy as to subsequent events.
5,6, Notices. Any notices to be given hereunder to a Party shall be made via U.S, Mail (via registered mail or certified mail,
postage pre-paid and return receipt requested) or express courier to such Party's address given below. Each Party may change its
address and that of its representative for notice by the giving of notice thereof in the manner herein above provided.
5.7. Counterparts; Facsimiles. This Agreement may be executed in counterparts, each of which will constitute an original and all
of which will be one and the same document. Facsimile copies or electronically signed or delivered versions hereof shall be deemed to
be originals.
5.8, Effective Date. The Effective Date of this Agreement shall be the date on which Customer has executed the Agreement.
5.9, Assignment. This Agreement shall be binding upon the Parties and their successors and permitted assigns.
5,10, No Third Party Beneficiaries. Nothing in this Agreement shall confer upon any person other than the Parties and their
respective successors or assigns, any rights, remedies, Obligations, or liabilities whatsoever.
5.11. Independent Contractor. Business Associate and Covered Entity are and shall remain independent contractors throughout
the term. Nothing in this Agreement shall be construed to constitute Business Associate and Covered Entity as partners, joint
venturers, agents or anything other than Independent contractors.
5.12, Contradictory Terms. Any other provision of the License Agreement that is directly contradictory to one or more terms of this
Agreement (*Contradictory Term') shall be superseded by the terms of this Agreement to the extent and only to the extent of the
contradiction, only for the purpose of Covered Entity's compliance with the HIPAA Rules, and only to the extent reasonably impossible
to comply with both the Contradictory Term and the terms of this Agreement.
5.13. Governing Law. This Agreement will be governed by and construed in accordance with the laws of the State of Georgia
(excluding its choice of law rules).
IN WITNESS WHEREOF, each of the undersigned has caused this Business Associate Agreement to be duly executed effective as of
the Effective Date.
Chri sty Hi gni ght
Naylcure, inc. Customer:
By: 6./ 9)1,.94.1 By:
(Type or print name): Bev Coleman (Type or print name): Christy Hi gnight
Title: Vice President — Human Resources/Compliance Officer Title: clai ms spedau St
Date: 8/22/2013
Page 3 of 3 ReviEed 7/1/13

IN WITNESS WHEREOF, the parties agree to enter into tMs Agreement:
FOR AND ON BEHALF OF
MAR1COPA COUNTY
By
Chairman, Board of Supervisors
Date
ATTEST:
Clerk of the Board
Date
APPROVED AS TO FORM:
Deputy Attorney for 1Vlaricopa County
Date