Business Associate Agreement with Ada County EMS for HIPAA Privacy
I°
r:
r.
/ ~'7
• }=+J
~-~
Agreement No. ~ '~
ADA COUNTY AND THE CITY OF MERIDIAN '
BUSINESS ASSOCIATE AGREEMENT
I~~~
~~ ~~~ ~ ~, ,. ~ ~r
THIS AGREEMENT is entered this ~ day of ~. ~ ~ ~ , 2012, between
and its Emer enc Medical Services District, a duly formed and existing ambulance
Ada County g y
district ursuant to the laws of the State of Idaho (hereinafter "Covered Entity"}, and the City of
p
Meridian and its Police Department (hereinafter "Business Associate"}.
WITNESSETH
WHEREAS, sections of the Health Insurance Portability and Accountability Act of 1996
HIPAA}, Known as the "Adminis~ative Simplification Provisions," direct the Department of
Health and Human Services to develop standards to protect the security, confidentiality and
integrity of health information. Pursuant to those provisions, the Secretary of Health and Hainan
Services has issued regulations known as the "HIPAA Privacy Rule;"
WHEREAS, to the extent to which Ada County EMS may be a covered entity pursuant
to HIPAA and maybe required to enter into a business associate agreement, the Parties wish to
enter into or have entered into an arrangement in which the Business Associate will. provide
certain services to the Covered Enti ,and since the Business Associate may have access to
Protected Health Information in fulfilling its responsibilities under the arrangement, the Parties
agree to the provisions of this Agreement in order to address the requirements of the HIPAA
Privacy Rule and to protect the interests of both Parties. .
NOW, THEREFORE, the parties hereto mutually agree as follows:
BUSINESS ASSOCIATE AGREEMENT BEWTEEN ADA COUNTY EMS AND THE CITY
OF MERIDIAN 2012-13--PAGE 1
n;lemslmeridian city business associatc agreement 2012-13,doc
~ Z
I. DEFINITIONS
Exce t as otherwise defined herein, any and all capitalized terms in the Agreement shall
p
have the definitions set forth in the HIPAA Privacy Rule. In the event of an inconsistency
between the rovisions of this Agreement and mandatory provisions of the HIPAA Privacy Rule,
p
as amended, the HIPAA Privacy Rule shall control. where provisions of this Agreement are
different than those mandated in the HIPAA Privacy Rule, but are nonetheless permitted by the
HIPAA Privacy Rule, the provisions of this Agreement shall control.
The Term "Protected Health Information"; means individually identifiable health
information, including without limitation, all demographic medical and financial information,
data, documentation, and materials, that relate to the past, present or future health status or health
care of an individual, and that identifies the individual or with respect to which there is a
reasonable basis to believe the information can be used to identify the individual.
The Business Associate acknowledges and agrees all the Protected Health Information
' ed or received b the Covered Enti and that is disclosed or made available in any
that ~s Great y tY
form, including paper, record, oral communication, audio recording, and electronic display by
the Covered Entity or its operating units, to the Business Associate, or that is created or received
by the Business Associate on the Covered Entity's behalf, shall be subject to this Agreement.
II. CONFIDENTIALITY REQUIREMENTS
(a) Business Associate agrees;
i. To use or disclose any Protected Health Information solely: (1 } for
meeting its obligations as set forth in any agreements between the
Parties to perform functions, activities, or services for, or on behalf
of, the Covered Entity or (2} as required by applicable law, rule or
BUSYNESS ASSOCIATE AGREEMENT BEWTEEN ADA COUNTY EMS AND THE CITY
OF MERIDIAN 2012-13--PAGE 2
n:lemslmeridian city business associate agreement 2Q12.13.doc
regulation or by an accrediting or credentializing organization to
whom the Covered Entity is required to disclose such information or
(3) as otherwise permitted under this Agreement or the HIPAA
Privac Rule and as would be ermitted by the HiPAA Privacy Rule
y P
if such use or disclosure were made by the Covered Entity;
t
ii. To ensure that its agents, including any subcontractors, to whom it
provides Protected Health Information that is received from or
created by the Business Associate on behalf of the Covered Entity,
agrees to the same restrictions and conditions that apply to the
Business Associate with respect to such information. In addition, the
Business Associate agrees to take reasonable steps to ensure that its
employees' actions or omissions do not cause the Business
Associate to breach the terms of this Agreement; and
111, At the termination of this Agreement, or upon the request of the
Covered Entity, whichever occurs first, the Business Associate will
return or destroy all Protected Health information received from or
created or received by the Business Associate on behalf of the
Covered Entity that the Business Associate still maintains in any
form and retain no copies of such information, if feasible. If such
return or destruction is not feasible, the Business Associate will
extend the protections of this Agreement to the information and
limit further uses and disclosures to those purposes that make the
return or destruuction of the information not feasible.
BUSINESS ASSOCIATE AGrREEMENT BEwTEEN ADA CQUNTY EMS AND THE CITY
OF MERIDIAN 2012-13 -PAGE 3
n;lemslmeridian city business associate agreement 2012-13.doc
e
(b) Notwithstanding the prohibitions set forth in this Agreement, the Business
Associate may use and disclose Protected Health Information as follows: `~
i. If necessary, for the proper management and administration of the
Business Associate or to carry out the legal responsibilities of the
Business Associate, provided that as to any such disclosure the
following requirements are met;
1. The disclosure is required by law; or
2. The Business Associate obtains reasonable assurances from
the person to whom the information is disclosed that it will
- be held confidentially and used or further disclosed only as
required by law for the purpose for which it was disclosed
to the person, and the person notifies the Business
Associate of any instances of which it is aware in which the
confidentiality ofthe information has been breached;
(c} The Business Associate will implement appropriate administrative and
h sical safe ands to revent the use or disclosure of Protected Health
py ~ P
Information other than for those uses or disclosures as permitted in this
Agreement, The Secretary of Health and Human Services shall have the right to
audit the Business Associates records and practices related to the use and
disclosure of Protected Health Information to ensure the Covered Entity's
compliance with the, terms of the HIPAA Privacy Rule. The Business Associate
shall report to the Covered Entity any use or disclosure of Protected Health -
Information which is not in compliance with the terms of this Agreement of
BUSINESS ASSOCIATE AGREEMENT BEWTEEN ADA COUNTY EMS AND THE CITY
OF MERIDIAN 2012-13 -PAGE 4
n;lemslmeridian city business associate agreement 2012-13.doc
which it becomes aware, In addition, the Business Associate agrees to mitigate, to
the extent practicable, any harmful effect that is known to the Business Associate
of a use or disclosure of Protected Health Information by the Business Associate
in violation of the requirements of this Agreement.
III, AVAILABILITY OF PHI
..
The Business Associate agrees to make Protected Health Information available to the
extent and manner required by the HIPAA Privacy Rule. The Business Associate agrees to make
Protected Health Information available for amendment and incorporate any amendments to
Protected Health Information in accordance with the requirements of the HIPAA Privacy Rule.
In addition, the Business Associate agrees to make Protected Health Information available far the
purposes of accounting of disclosures, as required by the HIPAA Privacy Rule,
N. TERMINATION
Notwithstanding anything in this Agreement to the contrary, either Party may terminate
this Agreement upon thirty (30) days written notice, The Covered Entity shall have the right to
terminate this Agreement immediately if the Covered Entity determines that the Business
Associate has violated any material term of this Agreement. If the Covered Entity reasonably
believes that the Business Associate will violate a material term of this Agreement, and where
racticable, the Covered Entity gives written notice to the Business Associate of such belief
p
within a reasonable time after forming such a belief, and the Business Associate fails to provide
adequate written assurances to the Covered Entity that it will not breach the cited term of this
Agreement within a reasonable period of time given the specific circumstances, but in any event,
before the threatened breach is to occur, then the Covered Entity shall have the right to terminate
this Agreement immediately.
BUSINESS ASSOCIATE AGREEMENT BEWTEEN ADA CdUNTY EMS AND THE CITY
OF MERIDIAN 2012-13--PAGE 5
n,lemslmeridian city business associate agreement 2012-13.doc
i
,y
V. MISCELLANEOUS
Exce t as ex ressly stated herein or in the HIPAA Privacy Rule, the Parties to this
p P
A eement do not intend to create any rights for third parties. The obligations of the Business
Associate under this A reement shall survive the expiration, termination or cancellation of this
g
A reement and/or the business relationship of the Parties, and shall continue to bind the Business
g
Associate, its agents, employees, contractors, successors and assignees as set forth herein.
To the extent it is applicable, both parties agree to abide by the Health Information
Technology for Economic and Clinical Health Act of 2009 (the "HITECH Act"}.
This Agreement may be amended or modified only in writing, and the amendment or
modification must be signed by both Parties. No Party may assign its respective rights and
obli ations under this Agreement without the consent of the other Party. None of the provisions
g
of this A reement are intended to create, nor will.. they be deemed to create, any relationship
g
between the Parties other than that of independent parties contracting with each other solely for
the oses of effecting the provisions of this Agreement and any other agreements between the
p~
Parties evidencin their business relationship. This Agreement will be governed by the laws of
g
the State of Idaho. No change, waiver or discharge of any liability or obligation hereunder on any
asions shall be deemed a waiver of erformance of any continuing or other
one or more occ P
obligation, or shall prohibit enforcement~of any obligation, on any other occasion.
The Parties agree that, in the event that any documentation of the arrangement pursuant
to which the Business Associate provides services to the Covered Entity contains provisions
relating to the use or disclosure of Protected Health Information which are more restrictive than
the rovisions of this Agreement, the provisions of the more restrictive documentation will
P
BUSINESS ASSOCIATE AGREEMENT BEWTEEN ADA COUNTY EMS AND THE CITY
OF MERIDIAN 201213 -PAGE 6
n:lemslmeridian city business associate agreement 2012-13.doc
control. The rovisions of this A Bement are intended to establish the minimum requirements
P ~
regarding the Business Associate's use and disclosure of Protected Health Information.
In the event that any provision of this Agreement is held by a court of competent ; i
~:
.,
F •.
'urisdiction to be invalid or unenforceable, the remainder of the provisions of this Agreement ~
J I:
Will remain in full force and effect. In addition, in the event a Party believes in good faith that
any provision of this Agreement fails to comply With the then-current requirements of the
HIPAA Privacy Rule, such party sha11 notify the other party in Writing. For a period of up to
thi 30 days, the Parties shall address in good faith such concern and amend the terms of this
rty ( }
Agreement, if necessary, to bring it into compliance. If, after such thirty (30} day period, the
Agreement fails to comply with the HIPAA Privacy Rule, and its requirements, then either Party
has the right to terminate upon written notice to the other Party.
IN ~ WITNESS WHEREOF, the parties have executed this Agreement on the date and
year written above.
Board of Ada County Commissioners
By~
Rick Yzaguirre, an
A~S~N~`
By;
Sh n M. Ullman, Commissioner
By;
v~ L. Case, Commissioner
ATTEST:
~~ ~ ~
Christop er D. Rich, Ada County Clerk
BUSINESS ASSOCIATE AGREEMENT BEWTEEN ADA COUNTY EMS AND THE CITY
OF MERIDIAN 2012-13 - PACrE 7
n;lemslmeridiancfty business associate agreement 2012-13.doc
~~+ t
City of Meridian
By:
Mayor T de Weerd
Mayor of 'than
ATTEST:
olman, Meridian City
4~Qgp,TED AvC~s~
G~ ~
~~ ~~~
(~ r- G3ity of
SEAL
~~
~~~ v~~
o~ f~'r~~AS~~~
'~ ~
BUSINESS ASSOCIATE ACrREEMENT BEWTEEN ADA COUNTS EMS AND THE CITX
OF MERIDIAN 20 12-13 - PACrE 8
n;lemslmeridiancfty business associate agreement 2012-13.doc