Loading...
HomeMy WebLinkAbout2006 S Health - Contract Renewal UNC Family Medicine and Health Dept. Business Associate Agreement BUSINESS ASSOCIATE AGREEMENT This Agreement is made effective the 1St of July, 2006, by and between Orange County Government, Health Department, hereinafter referred to as "Covered Entity", and UNC Department of Family Medicine, hereinafter referred to as "Business Associate," (individually, a "Party" and collectively, the "Parties"). WITNESSETH: WHEREAS, Sections 261 through 264 of the federal Health Insurance Portability and Accountability Act of 1996, Public Law 104-191, known as "the Administrative Simplification provisions," direct the Department of Health and Human Services to develop standards to protect the security, confidentiality and integrity of health information; and WHEREAS, pursuant to the Administrative Simplification provisions, the Secretary of Health and Human Services has issued regulations modifying 45 CFR Parts 160 and 164 (the "HIPAA Privacy Rule"); and WHEREAS, the Parties wish to enter into or have entered into an arrangement whereby Business Associate will provide certain services to Covered Entity, and, pursuant to such arrangement, Business Associate may be considered a "business associate" of Covered Entity as defined in the HIPAA Privacy Rule (the agreement evidencing such arrangement is entitled: Agreement for Medical Director Services, dated July 1, 2006, renewable annually, and is hereby referred to as the. "Arrangement Agreement"); and WHEREAS, Business Associate may have access to Protected Health Information (as defined below) in fulfilling its responsibilities under such arrangement; THEREFORE, in consideration of the Parties' continuing obligations under the Arrangement Agreement, the Parties agree to the provisions of this Agreement in order to address the requirements of the HIPAA Privacy Rule and to protect the interests of both Parties. DEFINITIONS Except as otherwise defined herein, terms used in this Agreement shall have the same meaning as those terms set forth in the HIPAA Privacy Rule. II. CONFIDENTIALITY REQUIREMENTS (a) Business Associate shall: (i) use or disclose any protected health information solely as permitted or required by this Agreement, the Arrangement Agreement (if consistent with this Agreement and the HIPAA Privacy Rule), or as required by law.' (ii) ensure that its agents, including a subcontractor, to whom it provides protected health information received from or created by Business Associate on behalf of Covered Entity, agrees to the same restrictions and conditions that apply to Business Associate with respect to such information. In addition, Business Associate agrees to take reasonable steps to ensure that its employees' actions or omissions do not cause Business Associate to breach the terms of this Agreement; (iii) implement appropriate safeguards to prevent use or disclosure of protected health information other than as permitted or required by this Agreement; (iv) permit the Secretary of Health and Human Services to audit Business Associate's records and practices related to use and disclosure of protected health information to ensure Covered Entity's compliance with the terms of the HIPAA Privacy Rule; L:\ROSIE\HIPPA\BBA Fam Practice Med Contract 06.doc Page 1 of 4 (v) report to Covered Entity any use or disclosure of protected health information which is not in compliance with the terms of this Agreement of which it becomes aware; and (vi) mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of protected health information by Business Associate in violation of the requirements of this Agreement. (b) Notwithstanding the prohibitions set forth in this Agreement or the Arrangement Agreement, Business Associate may use and disclose protected health information as follows: (i) if necessary, for the proper management and administration of Business Associate or to carry out the legal responsibilities of Business Associate, provided that as to any such disclosure, the following requirements are met: (A) the disclosure is required by law; or (B) Business Associate obtains reasonable assurances from the person to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached; (ii) for data aggregation services, if such services are to be provided by Business Associate for the health care operations of Covered Entity pursuant to any agreements between the Parties evidencing their business relationship. III. AVAILABILITY OF PROTECTED HEALTH INFORMATION Business Associate shall: (a) at the request of Covered Entity, provide access to protected health information in a designated record set to Covered Entity or, as directed by Covered Entity, to an individual, in a time and manner sufficient to permit Covered Entity to comply with the requirements of 45 CFR 164.524. (b) at the request of Covered Entity or an individual, make any amendment(s) to protected health information in a designated record set that are directed by or agreed to by Covered Entity, in a time and manner sufficient to permit Covered Entity to comply with the requirements of 45 CFR 164.526. (c) document disclosures of protected health information and information related to such disclosures in a manner sufficient to permit Covered Entity to respond to a request by an individual for an accounting of disclosures of protected health information in accordance with 45 CFR 164.528 and provide such documentation to Covered Entity or an individual as directed by Covered Entity. IV. TERMINATION (a) Term: This Agreement terminates when the Arrangement Agreement terminates or as provided in Paragraph IV.b. below (termination for cause). (b) Termination for cause: Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall either: (i) provide an opportunity for Business Associate to cure the breach or end the violation or, if Business Associate does not cure the breach or end the violation within the time specified by Covered Entity, terminate this Agreement and the Arrangement Agreement; or (ii) immediately terminate this Agreement and the Arrangement Agreement if Business Associate has breached a material term of this Agreement and cure is not possible. L:\ROSIE\HIPPA\BBA Fam Practice Med Contract 06.doc Page 2 of 4 (c) Return or destruction of protected health information: At termination of this Agreement, the Arrangement Agreement (or any similar documentation of the business relationship of the Parties), or upon request of Covered Entity, whichever occurs first, Business Associate shall: (i) if feasible, return or destroy all protected health information received from or created or received by Business Associate on behalf of Covered Entity that Business Associate still maintains in any form. Business Associate shall only destroy protected health information with the written approval of Covered Entity. After return or destruction, Business Associate shall retain no copies of such information. (ii) if return or destruction is not feasible, Business Associate will provide Covered Entity with documentation explaining the reason that it is not feasible. If the protected health information is not returned or destroyed, Business Associate will extend the protections of this Agreement to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information not feasible. (d) Survival: The obligations of Business Associate under this Agreement shall survive the expiration, termination, or cancellation of this Agreement, the Arrangement Agreement and/or the business relationship of the parties, and shall continue to bind Business Associate, its agents, employees, contractors, successors, and assigns as set forth herein. V. MISCELLANEOUS (a) All protected health information that is created or received by Covered Entity and disclosed or made available in any form, including paper record, oral communication, audio recording, and electronic display by Covered Entity or its operating units to Business Associate or is created or received by Business Associate on Covered Entity's behalf shall be subject to this Agreement. (b) A reference in this Agreement to a section in the HIPAA Privacy Rule means the section as in effect or as amended. (c) In the event of an inconsistency between the provisions of this Agreement (including definitions) and mandatory provisions of the HIPAA Privacy Rule, as amended, the HIPAA Privacy Rule shall control. Where provisions of this Agreement are different than those mandated in the HIPAA Privacy Rule, but are nonetheless permitted by the HIPAA Privacy Rule, the provisions of this Agreement shall control. (d) Except as expressly stated herein or the HIPAA Privacy Rule, the parties to this Agreement do not intend to create any rights in any third parties. (e) This Agreement may be amended or modified only in a writing signed by the Parties. No Party may assign its respective rights and obligations under this Agreement without the prior written consent of the other Party. None of the provisions of this Agreement are intended to create, nor will they be deemed to create any relationship between the Parties other than that of independent parties contracting with each other solely for the purposes of effecting the provisions of this Agreement and any other agreements between the Parties evidencing their business relationship. (f) This Agreement will be governed by the laws of the State of North Carolina. (g) No change, waiver or discharge of any liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other occasion. (h) The parties agree that, in the event that any documentation of the arrangement pursuant to which Business Associate provides services to Covered Entity contains provisions relating to the use or disclosure of protected health information that are more restrictive than the provisions of this Agreement, the provisions of the more restrictive documentation will control. L:\ROSIE\HIPPA\BBA Fam Practice Med Contract 06.doc Page 3 of 4 (i) fn the event that any provision of this Agreement is held by a court of competent jurisdiction to be invalid or unenforceable, the remainder of the provisions of this Agreement will remain in full force and effect. Q) The headings in this Agreement are for convenience of reference only and shall not define or limit any of the terms or provisions hereof. above. IN WITNESS WHEREOF, the Parties have executed this Agreement as of the day and year written COVERED ENTITY: By: Title: 5 (> >° ss `~(~ BUSINESS ASSOCIATE: By: it am .Roper, PH 1/ ~ ~~ D n, S hool of Medicine Vice Chancellor for Medical Affairs Title: L:\ROSIE\HIPPA\BBA Fam Practice Med Contract 06.doc Page 4 of 4