Loading...
HomeMy WebLinkAboutBusiness Associate Agreement with ADA County EMSAgreement No. ~~ 1 ADA C GUNTY AND THE CITY OF MERIDIAN BUSINESS ASSGCIATE AGREEMENT THIS AGREEMENT is entered this v2 day of (~" ~~~ , 2007, between Ada County and its Emergency Medical Services Department, a duly formed and existing county pursuant to the laws and Constitution of the State of Idaho thereinafter "Covered Entity"}, and The City of Meridian and its Police Department thereinafter "Business Associate"}. WITNESSETH WHEREAS, sections of the Health Insurance Portability and Accountability Act of 1996 HIPAA}, known as the "Administrative Simplification Provisions," direct the Department of Health and Human Services to develop standards to protect the security, confidentiality and integrity of health information. Pursuant to those provisions, the Secretary of Health and Human Services has issued regulations known as the "HIPAA Privacy Rule;" WHEREAS, to the extent to which Ada County EMS may be a covered entity pursuant to HIPAA and maybe required to enter into a business associate agreement, the Parties wish to enter into or have entered into an arrangement in which the Business Associate will provide certain services to the Covered Entity, and since the Business Associate may have access to Protected Health Information in fulfilling its responsibilities under the arrangement, the Parties agree to the provisions of this Agreement in order to address the requirements of the HIPAA Privacy Rule and to protect the interests of both Parties. NGW, THEREFGRE, the parties hereto mutually agree as follows: BUSINESS ASSaCIATE AGREEMENT BEWTEEN ADA CaUNTY EMS AND THE CITY OF MERIDIAN ~-PAGE 1 n:lemslmeridian city business associate agreement 07 08.doc SRV2047044b4 I. DEFINITIONS Except as otherwise defined herein, any and all capitalized terms in the Agreement shall have the definitions set forth in the HIPAA Privacy Rule. In the event of an inconsistency between the provisions of this Agreement and mandatory provisions of the HIPAA Privacy Rule, as amended, the HIPAA Privacy Rule shall control. 'Where provisions of this Agreement are different than those mandated in the HIPAA Privacy Rule, but are nonetheless permitted by the HIPAA Privacy Rule, the provisions of this Agreement shall control. The Term "Protected Health Information": means individually identifiable health information, including without limitation, all demographic medical and financial information, data, documentation, and materials, that relate to the past, present or future health status or health care of an individual, and that identif es the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. The Business Associate acknowledges and agrees all the Protected Health Infarmation that is created or received by the Covered Entity and that is disclosed or made available in any form, including paper, record, oral communication, audio recording, and electronic display by the Covered Entity or its operating units, to the Business Associate, or that xs created or received by the Business Associate on the Covered Entity's behalf, shall be subject to this Agreement. II. CONFIDENTIALITY REQUIREMENTS (a) Business Associate agrees: i. To use or disclose any Protected Health Information solely: (1) for meeting its obligations as set forth in any agreements between the Parties to perform functions, activities, or services for, or on behalf of, the Covered Entity or ~2} as required by applicable law, rule or BUSINESS ASSOCIATE AGREEMENT BEwTEEN ADA CGUNTY EMS AND THE CITY GF MERIDIAN -PAGE 2 n:lemslmeridian city business associate agreement U7 08.doc SRV2~4704~64 regulation or by an accrediting ar credentializing organization to whom the Covered Entity is required to disclose such information or (3) as otherwise permitted under this Agreement or the HIPAA Privacy Rule, and as would be permitted by the HIPAA Privacy Rule if such use or disclosure were made by the Covered Entity; 11, To ensure that its agents, including any subcontractors, to whom it provides Protected Health Information that is received from or created by the Business Associate on behalf of the Covered Entity, agrees to the same restrictions and conditions that apply to the Business Associate with respect to such information. In addition, the Business Associate agrees to take reasonable steps to ensure that its employees' actions or omissions do not cause the Business Associate to breach the terms of this Agreement; and iii. At the termination of this Agreement, or upon the request of the Covered Entity, whichever occurs first, the Business Associate will return or destroy all Protected Health Information received from ar created or received by the Business Associate on behalf of the Covered Entity that the Business Associate still maintains in any form and retain no copies of such information, if feasible. If such return or destruction is not feasible, the Business Associate will extend the protections of this Agreement to the information and limit further uses and disclosures to those purposes that make the return ar destruction of the information not feasible, BUSINESS ASSGCIATE AGREEMENT BEwTEEN ADA COUNTY EMS AND THE CITY OF MERIDIAN -PAGE 3 n:lemslmeridian city business associate agreement 07 OS.doc SRV2a0744464 fib} Notwithstanding the prohibitions set forth in this Agreement, the Business Associate may use and disclose Protected Health information as follows: i. zf necessary, for the proper management and administration of the Business Associate or to carry out the legal responsibilities of the Business Associate, provided that as to any such disclosure the following requirements are met: l . The disclosure is required by law; or 2. The Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law for the purpose for which it was disclosed to the person, and the person notifies the Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached; (c) The Business Associate will implement appropriate administrative and physical safeguards to prevent the use or disclosure of Protected Health Information other than far those uses or disclosures as permitted in this Agreement. The Secretary of Health and Human Services shall have the right to audit the Business Associates records and practices related to the use and disclosure of Protected Health Information to ensure the Covered Entity's compliance with the terms of the HIPAA Privacy Rule. The Business Associate shall report to the Covered Entity any use or disclosure of Protected Health Information which is not in compliance with the terms of this Agreement of BUSINESS ASSOCIATE AGREEMENT BEwTEEN ADA COUNTY EMS AND THE CITY OF MERIDIAN--PAGE 4 n:lemslmeridiancfty business associate agreement Q7 QB.doc SRV2007U446~ which it becomes aware. In addition, the Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of Protected Health Infarmation by the Business Associate in violation of the requirements of this Agreement. III. AVAILABILITY GF PHI The Business Associate agrees to make Protected Health Information available to the extent and manner xequired by the HIPAA Privacy Rule. The Business Associate agrees to make Protected Health Information available for amendment and incorporate any amendments to Protected Health Information in accordance with the requirements of the HIPAA Privacy Rule. In addition, the Business Associate agrees to make Protected Health Information available for the purposes of accounting of disclosures, as required by the HIPAA Privacy Rule. IV. TERMINATIQN Notwithstanding anything in this Agreement to the contrary, either Party may terminate this Agreement upon thirty (30) days written notice. The Covered Entity shall have the right to terminate this Agreement immediately if the Covered Entity determines that the Business Associate has violated any material term of this Agreement. If the Covered Entity reasonably believes that the Business Associate will violate a material term of this Agreement, and where practicable, the Covered Entity gives written notice to the Business Associate of such belief within a reasonable time after forming such a belief, and the Business Associate fails to provide adequate written assurances to the Covered Entity that it will not breach the cited term of this Agreement within a reasonable period of time given the specific circumstances, but in any event, before the threatened breach is to occur, then the Covered Entity shall have the right to terminate this Agreement immediately. BUSINESS ASSOCIATE AGREEMENT BEwTEEN ADA CGIJNTY EMS AND THE CITY GF MERIDIAN -PAGE 5 n:lemslmeridian city business associate agreement 47 48.doc SRV244744464 V. MISCELLA.NEGUS Except as expressly stated herein or in the HIPAA Privacy Rule, the Parties to this Agreement do not intend to create any rights for third parties. The obligations of the Business Associate under this Agreement shall survive the expiration, termination or cancellation of this Agreement andlor the business relationship of the Parties, and shall continue to bind the Business Associate, its agents, employees, contractors, successors and assignees as set forth herein. This Agreement may be amended or modifiied only in writing, and the amendment or modification must be signed by both Parties. No Parry may assign its respective rights and obligations under this Agreement without the consent of the other Party. None of the provisions of this Agreement are intended to create, nor will they be deemed to create, any relationship between the Parties other than that of independent parties contracting with each other solely for the purposes of effecting the provisions of this Agreement and any other agreements between the Parties evidencing their business relationship. This Agreement will be governed by the laws of the State of Idaho. No change, waiver or discharge of any liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other occasion. The Parties agree that, in the event that any documentation of the arrangement pursuant to which the Business Associate provides services to the Covered Entity contains provisions relating to the use or disclosure of Protected Health Information which are more restrictive than the provisions of this Agreement, the provisions of the more restrictive documentation will control. The provisions of this Agreement are intended to establish the minimum requirements regarding the Business Associate's use and disclosure of Protected Health Information. BUSINESS ASSaCIATE AGREEMENT BEWTEEN ADA COUNTY EMS AND THE CITY 4F MERIDIAN -PAGE 6 n:lemslmeridianchy business associate agreement 07 ~S.dac SRV2007~44b4 In the event that any provision of this Agreement is held by a court of competent jurisdiction to be invalid or unenforceable, the remainder of the provisions of this Agreement will remain in full force and effect. In addition, in the event a Party believes in good faith that any provision of this Agreement fails to comply with the then-current requirements of the HIPAA Privacy Rule, such party shall notify the other party in writing. For a period of up to thirty (30) days, the Parties shall address in good faith such concern and amend the terms of this Agreement, if necessary, to bring it into compliance. If, after such thirty X30} day period, the Agreement fails to comply with the HIPAA Privacy Rule, and its requirements, then either Party has the right to terminate upon written notice to the other Party. IN WITNESS WHEREUF, the parties have executed this Agreement on the date and year written above. Board of Ada County Commissioners By: Fred Tilman, Chairman By: ~ _ ~, ~ Paul R. Woods, Commissioner By: Rick Yzaguirre, ssioner ATTEST: . David Navarro, Ada County Clerk BUSINESS ASSOCIATE AGREEMENT BEwTEEN ADA CaUNTY EMS AND THE CITY OF MERIDIAN -PAGE 7 n:lemslmeridian city business associate agreement 07 ~8.doc SRV~0~7D446Q~ City of Meridian By: ~ cam. Mayor T y e Weerd Mayor of e ' ian Mer By: By: ~.cttii ~iru • ~~~ Charlie Roundtree David Zarem a AT'TEST• i~---- t William Berg, Jr., Meridian ity erk BUSINESS ASSGCIATE AGREEMENT BE~V'TEEN ADA CGUNTY EMS AND THE CITY GF MERZDrAN -PAGE 8 n:lemslmeridian city business asspciate agreement a7 08.dpc SRV2Q07044b4