HomeMy WebLinkAbout2014-301 Health - M. Monica Meng-Haggerty to provide services to OCHD's Dental Clinic $11,200 X0/41-_30�
[Departmental Use Only]
Title M. Monica Meng-Haggerty, DDS
FY 2014 - 2015
NORTH CAROLINA
DENTAL SERVICE AGREEMENT
ORANGE COUNTY
This Services Agreement (hereinafter "Agreement"), made and entered into this first day of
July, 2014 ("Effective Date") by and between Orange County, a body politic and corporate of the
State of North Carolina (hereinafter, the "County") on behalf of the Orange County Health
Department("OCHD") and M. Monica Meng-Haggerty, DDS, (hereinafter,the "Provider").
WITNESSETH:
That the County and Provider, for the consideration herein named, do hereby agree as
follows:
1. Services
a. Scope of Work
i. This Agreement is for services to be rendered by Provider to County with
respect to dental services and patient care at Orange County Health
Department Clinics in Carrboro and Hillsborough.
ii. By executing this Agreement, the Consultant represents and agrees that
Consultant is currently licensed and registered to provide such services in the
State of North Carolina and is therefore qualified to perform and provide the
services required or necessary under this Agreement in a fully competent,
professional and timely manner.
iii. Time is of the essence with respect to this Agreement.
iv. The services to be performed under this Agreement consist of Basic Services,
as described and designated in Section 3 hereof. Compensation to the Provider
for Basic Services under this Agreement shall be as set forth herein.
2. Responsibilities of the Provider
a. Services to be Provided. The Consultant shall provide the County with all services
required in Article 3 to satisfactorily complete the Project within the time limitations
set forth herein and in accordance with the highest professional standards.
b. Standard of Care
i. The Provider shall exercise reasonable care and diligence in performing
services under this Agreement in accordance with the highest generally
accepted standards of this type of Provider practice throughout the United
States and in accordance with applicable federal, state and local laws and
regulations applicable to the performance of these services. Provider is solely
responsible for the professional quality, accuracy and timely completion of all
dental services (hereinafter"Deliverables")related to the Basic Services.
ii. The Provider shall be responsible for all errors or omissions, in the
performance of the Agreement. Provider shall correct any and all errors,
omissions, discrepancies, ambiguities, mistakes and conflicts at no additional
cost to the County.
iii. The Provider shall not, except as otherwise provided for in this Agreement,
subcontract the performance of any work under this Agreement without prior
written permission of the County. No permission for subcontracting shall
create, between the County and the subcontractor, any contract or any other
relationship.
iv. Provider is an independent contractor of the County. Any and all employees
of the Provider engaged by the Provider in the performance of any work or
services required of the Provider under this Agreement, shall be considered
employees or agents of the Provider only and not of the County, and any and
all claims that may or might arise under any workers compensation or other
law or contract on behalf of said employees while so engaged shall be the sole
obligation and responsibility of the Provider.
v. If activities related to the performance of this agreement require specific
licenses, certifications, or related credentials Provider represents that they
possess such licenses, certifications, or credentials and that such licenses
certifications, or credentials are current, active, and not in a state of suspension
or revocation.
vi. Provider shall comply with the terms of the Business Associate Agreement
which is attached as Exhibit A, and is hereby incorporated by reference.
3. Basic Services
a. Basic Services. The Services to be rendered pursuant to this Agreement are as
follows:
i. Basic Service. The Provider will render professional dental services patient
care at the OCHD clinics.
ii. Performance of Basic Services.
1. The Provider will maintain current registration and licensure and
warrants such to OCHD.
2. The Provider will insure self for malpractice, which insurance will also
cover Orange County when possible.
2
3. The Provider will relate to all patients and staff of OCHD in a
professional and instructional manner.
4. The Provider will practice dentistry in accord with then accepted
methods and procedure.
iii. Provider agrees to help OCHD arrange back-up coverage in the instance of
necessary absence.
iv. The Provider hereby agrees to furnish services to OCHD patients without
regard to race, color, religion, sex, national origin or handicapping condition.
The Provider hereby agrees to abide by the pertinent rules and regulations of
OCHD, Orange County, and the North Carolina Division of Health Services in
the conduct of services.
4. Duration of Services.
a. Term of the Agreement. The term of this Agreement shall be July 1, 2014 through
June 30, 2015.
b. Scheduling of Services.
1. The Provider shall schedule and perform the activities in a timely
manner.
2. The Provider shall commence work at the beginning of the clinic work
day, 8:00 a.m., and terminate service when the last patient is seen
following the close of registration at 5:00 p.m. The Provider shall be
entitled to a lunch break of one hour and sufficient other breaks as
necessary to maintain productivity.
3. Should the County determine the Provider is behind schedule, it may
require the Provider to expedite services and accelerate their efforts
including providing additional resources and working overtime, as
necessary, to perform his services in accordance with the terms this
Agreement.
4. The commencement date of the services shall be July 1, 2014.
5. Compensation
a. Compensation for Basic Services. Compensation for Basic Services shall
include all compensation due to the Provider from the County for all services
under this Agreement except for any authorized Reimbursable Expenses which
may be defined herein. The Provider shall receive $700.00 for each clinic
worked, but the maximum amount payable for Basic Services shall not exceed
Eleven Thousand Two Hundred dollars ($11,200). The Provider shall submit
to OCHD by the nearest workday to the 20th day of each month an invoice for
services rendered during the month preceding the 16th day of the month.
3
OCHD will then submit a request for a check to the Orange County Finance
Department. The Finance Department will then prepare a check for Provider
based on their schedule which will be mailed to provider on or about the 1St
day of the month.
b. Disputes. In the event the amount stated on an invoice is disputed by the
County, the County may withhold payment of all or a portion of the amount
stated on an invoice until the parties resolve the dispute. Should Provider fail
to perform its duties under the terms of this Agreement, County may, without
any payment associated with the work be performed until such time as said
work is completed.
C. Additional Services. County shall not be responsible for costs related to any
services in addition to the Basic Services performed by Provider unless County
requests such additional services in writing and such additional service in
writing and such additional services are evidenced by a written amendment to
this Agreement.
6. Responsibilities of the County
a. Cooperation and Coordination. The County has designated the Orange County
Health Director to act as the County's representative with respect to this
Agreement and she shall have the authority to render decisions within guidelines
established by the County Manager and/or the County Board of Commissioners
and shall be available during working hours as often as may reasonably be
required to render decisions and to furnish information.
b. OCHD shall determine the patient load of the Provider in consultation with
Provider.
C. OCHD agrees to furnish all supplies, equipment and other staff needed by the
Provider within the budgetary constraints of OCHD.
7. Insurance.
a. General Requirements. The Provider shall purchase and maintain during the
period of performance of this Agreement Professional Liability Insurance,
covering personal injury, bodily injury and property damage and claims arising out
of or related to the performance under this Agreement by the Provider or his
agents, Providers and employees.
b. Limits of Coverage. The Provider shall maintain professional liability
insurance coverage with coverage of at least $1 million, per occurrence, $3 million
aggregate while providing services to the County.
C. Evidence of Insurance. Evidence of such insurance shall be furnished to the
County, together with evidence that each policy provides the County with not less
than thirty (30) days prior written notice of any cancellation, non-renewal or
reduction of coverage.
4
8. Indemnity
a. Indemnity. The Provider agrees to defend, indemnify and hold harmless the County
from all loss, liability, claims or expense, including attorney's fees, arising out of
or related to the Project and arising from bodily injury including death or property
damage to any person or persons caused in whole or in part by the negligence or
misconduct of the Provider except to the extent same are caused by the negligence
or willful misconduct of the County. It is the intent of this provision to require the
Provider to indemnify the County to the fullest extent permitted under North
Carolina law.
9. Amendments to the Agreement
a. Changes in Basic Services. Changes in the Basic Services and entitlement to
additional compensation or a change in duration of this Agreement shall be made
by a written Amendment to this Agreement executed by the County and the
Provider. The Provider shall proceed to perform the Services required by the
Amendment only after receiving a fully executed Amendment from the County.
10. Termination
a. Termination for Convenience. This Agreement may be terminated without cause
by the Parties for their convenience upon thirty (30) days' prior written notice to
the other Party.
b. Other Termination. Either Party may terminate this Agreement based upon the
other Party's material breach of this Agreement; provided, the Party committing
the material breach has not taken all reasonable actions to remedy the breach. The
Parry terminating the Agreement shall give the other Party seven (7) days' prior
written notice of its intent to terminate this Agreement for cause.
C. Compensation After Termination.
i. In the event of termination, the Provider shall be paid that portion of the fees
and expenses that it has earned to the date of termination, less any costs or
expenses incurred or anticipated to be incurred by the County due to errors or
omissions of the Provider.
ii. Should this Agreement be terminated, the Provider shall deliver to the County
within seven (7) days, at no additional cost, all deliverables including any
electronic data or files relating to the Project.
d. Waiver. The payment of any sums by the County under this Agreement or the
failure of the County to require compliance by the Provider with any provisions of
this Agreement or the waiver by the County of any breach of this Agreement shall
not constitute a waiver of any claim for damages by the County for any breach of
this Agreement or a waiver of any other required compliance with this Agreement.
5
11. Additional Provisions
a. Limitation and Assignment. The County and the Provider each bind themselves,
their successors, assigns and legal representatives to the terms of this Agreement.
Neither the County nor the Provider shall assign or transfer its interest in this
Agreement without the written consent of the other.
b. Governing Law. This Agreement and the duties, responsibilities, obligations and
rights of respective parties hereunder shall be governed by the laws of the State of
North Carolina.
C. Compliance with Laws. Provider shall at all times remain in compliance with all
applicable local, state, and federal laws, rules, and regulations including but not
limited to all anti-discrimination laws. Pursuant to the terms of North Carolina
General Statute 153A-449(b) no county may enter into a contract with a contractor
unless the contractor and the contractor's subcontractors comply with the
requirements of Article 2 of Chapter 64 of the North Carolina General Statutes.
Where applicable, failure to maintain compliance with the requirements of Article
2 of Chapter 64 of the General Statutes constitutes Provider's breach of this
Agreement. By executing this Agreement Provider affirms Provider is in
compliance with Article 2 of Chapter 64 of the North Carolina General Statutes.
d. Dispute Resolution. Any and all suits or actions to enforce, interpret or seek
damages with respect to any provision of, or the performance or non-performance
of, this Agreement shall be brought in the General Court of Justice of North
Carolina sitting in Orange County, North Carolina. It is agreed by the parties that
no other court shall have jurisdiction or venue with respect to such suits or actions.
The Parties may agree to nonbinding mediation of any dispute prior to the bringing
of such suit or action.
e. Entire Agreement. This Agreement represents the entire and integrated agreement
between the County and the Provider and supersedes all prior negotiations,
representations or agreements, either written or oral. This Agreement may be
amended only by written instrument signed by both parties. Modifications may be
evidenced by facsimile signatures.
f. Severability. If any provision of this Agreement is held as a matter of law to be
unenforceable, the remainder of this Agreement shall be valid and binding upon
the Parties.
g. Non-Appropriation. Provider acknowledges that County is a governmental entity,
and the validity of this Agreement is based upon the availability of public funding
under the authority of its statutory mandate.
In the event that public funds are unavailable and not appropriated for the
performance of County's obligations under this Agreement, then this Agreement
shall automatically expire without penalty to County immediately upon written
notice to Provider of the unavailability and non-appropriation of public funds. It is
expressly agreed that County shall not activate this non-appropriation provision for
6
its convenience or to circumvent the requirements of this Agreement, but only as
an emergency fiscal measure during a substantial fiscal crisis.
In the event of a change in the County's statutory authority, mandate and/or
mandated functions, by state and/or federal legislative or regulatory action, which
adversely affects County's authority to continue its obligations under this
Agreement, then this Agreement shall automatically terminate without penalty to
County upon written notice to Provider of such limitation or change in County's
legal authority.
h. Notices. Any notice required by this Agreement shall be in writing and delivered
by certified or registered mail, return receipt requested to the following:
Orange County Provider's Name
Attention: Colleen Bridger M. Monica Meng-Haggerty, DDS
P.O. Box 8181 215 Bluefield Rd.
Hillsborough,NC 27278 Chapel Hill,NC 27517
i. Independent Contractor: The Provider shall operate as an independent Provider,
and the County shall not be responsible for any of the Provider's acts or omissions.
The Provider shall not be treated as an employee with respect to the Services
performed hereunder for federal or state tax, unemployment or workers'
compensation purposes.
j. Priori : In determining the basic services to be provided, should any documents
be referenced in this Agreement, the terms herein shall have priority in any
conflict between the terms of referenced documents and the terms of this
Agreement, except the Business Associate Agreement.
IN WITNESS WHEREOF, the Parties, by and through their authorized agents, have
hereunder set their hands and seal, all as of the day and year first above written.
[SIGNATURE PAGE TO FOLLOW]
ORANGE COUN PROVIDER:
By: By' - ����1�'.
Michael Talbert, County M pager
lJG
Printed Name and Title
Federal Tax ID #:
7
This instrument has been approved as to technical content.
Colleen Bridger, Health Doo&rtment Director
This instrument has been pre-audited in the manner required by the Local Government Budget and
Fiscal Control Act.
j C"
Clarence G. Grier, Asst. County Manager/CFO
T n as been approved as to form and legal sufficiency.
Moore, Staff Attorney, Office of the County Attorney
8
CERTIFICATE OF LIABILITY INSURANCE 04/01/2014
PRODUCER/AGENT THIS CERTIFICATE IS ISSUED AS A MATTER OF INFORMATION ONLY
Dentist's Advantage AND CONFERS NO RIGHTS UPON THE CERTIFICATE HOLDER. THIS
159 East County Line Road CERTIFICATE DOES NOT AMEND,EXTEND OR ALTER THE COVERAGE
Hatboro,PA 19040 AFFORDED BY THE POLICIES BELOW.
Phone-866-2.19-6533 FRX7 866-202-6601 INSURERS AFFORDING COVERAGE
INSURED INSURER A: National Union Fire Insurance Company of Pittsburgh,PA.
Meng Monica Meng-Haggerty,DDS INSURER B:
215 Bluefield Rd INSURER C:
Chapel Hill,NC 27517 INSURER D:
INSURER E:
COVERAGES
THE POLICIES OF INSURANCE LISTED BELOW HAVE BEEN ISSUED TO THE INSURED NAMED ABOVE FOR THE POLICY PERIOD INDICATED. NOTWITHSTANDING ANY
REQUIREMENT,TERM OR CONDITION OF ANY CONTRACT OR OTHER DOCUMENT WITH RESPECT TO WHICH THIS CERTIFICATE MAY BE ISSUED OR MAY PERTAIN,
THE INSURANCE AFFORDED BY THE POLICIES DESCRIBED HEREIN IS SUBJECT TO ALL THE TERMS,EXCLUSIONS AND CONDITIONS OF SUCH POLICIES. AGGREGATE
LIMITS SHOWN MAY HAVE BEEN REDUCED BY PAID CLAIMS.
INSRLTR TYPE OF INSURANCE POLICY FFECTIVE POLICY EXPIRATION LIMITS
POLICY NUMBER DATE(MM/DDNY) DATE(MM/DDNY)
GENERAL LIABILITY EACH OCCURRENCE Not Included
❑COMMERCIAL GENERAL LIABILITY TENANTS'LEGAL LIABILITY Not Included
❑CLAIMS MADE❑OCCURRENCE MED EXP(An)one person) Not Included
❑ PERSONAL 8•ADV INJURY Not Included
GENERAL AGGREGATE Not Included
❑ PRODUCTS-COMP/OP AGG Not Included
GEN'L AGGREGATE LIMIT APPLIES PER:
❑POLICY ❑ PROJECT ❑LOC
AUTOMOBILE LIABILITY - COMBINED SINGLE LIMIT
El ANY AUTO aent
BODILY Not Included
11 ALL OWNED AUTOS An pen n)
one rso
1:1 BODILY INJURY NOt Included
SCHEDULED AUTOS (Per cident
❑HIRED AUTOS ac
❑NON-OWNED AUTOS PROPERTY DAMAGE
❑ (Per accident)
GARAGE LIABILITY AUTO ONLY-EACH ACCIDENT
❑ANY AUTO EA ACC
❑ OTHER THAN AUTO ONLY:
AGG
EXCESS LIABILITY EACH OCCURRENCE
❑ CLAIMS MADE ❑OCCURRENCE AGGREGATE
❑ DEDUCTIBLE
❑ RErENTiON
WORKER'S COMPENSATION AND ❑WC STATUTORY ❑OTHER
EMPLOYER'S LIABILITY
E.L.EACH ACCIDENT
E.L.DISEASE-EACH
EMPLOYEE
E.L.DISEASE-POLICY LIMIT
OTHER
A Med,Malpractice DNU 083946381 04/09/2014 04/09/2015 Per Claim: $1,000,000
Retroactive Date: Aggregate: IS3,000,000
DESCRIPTION OF OPERATIONS/LOCATIONSNEHICLES/EXCLUSIONS ADDED BY ENDORSEMENT/SPECIAL PROVISIONS
Insured Dentist: Retro Date: Insured Location:
Meng Monica M Men -Haggerty,DDS 215 Bluefield Rd,Chapel Hill,NC 27517
CERTIFICATE HOLDER ADDITIONAL INSURED;INSURER LETTER: CANCELLATION
THIS CERTIFICATE IS PROVIDED AS PROOF THAT A POLICY OF INSURANCE IS OR HAS BEEN IN
FORCE.IT IS NOT A GUARANTEE THAT THIS COVERAGE CONTINUES IN FORCE.FURTHERMORE,
AS A CERTIFICATE HOLDER,YOU WILL NOT BE PROVIDED WITH NOTICE SHOULD THE
INSURANCE COVERAGE DESCRIBED BE TERMINATED.
1
Dentist's Advantage
# V;'
�x� s
hfU
All,
t!VMMRE1 k ket{tin
e? 2v p E
+t.
� h
µr K 5;
ywy
} .iP
"Y a
xk
x.s.
0
Arta
3.
�Sa
�4
North Carolina State Board of Dental Examiners Page 1 of 1
4'E B�ARp Home Board Staff Login
` r
FAQs Links What's New Live Scan Contact Us
mid
Rules&Laws
License&Permits E ,"1 luadpcp License Renewal tr
Fees
License Verification
Disciplinary Action —
Continuing Education
Dental Assisting
Filing Complaint
Publications search results
Functions of the Board
Meeting Announcements of Dental Examiners
Management Arrangements DENTISTS ■ The administration of
Forms Dr.Hang Monica He licensure examinations for
Meng-Haggerty License aK: 8771(ucensed Dentist) dentists and dental
Professional Corporation ity: Chapel Hill License Issued: 5/19/2009 hygienists
tats:NC Expiration: 3/31/2015
Online Examination Board Action: N Status: Good Standing ■ The promulgation of rules
asthesia: N Sedation: N and enforcement of laws
Board Newsletter New Search and regulations governing
the practice of dentistry
and dental hygiene in this
state
■ The issuance and renewal
of licenses to dentists and
dental hygienists
info @nedentalboard.org 02012 North Carolina State Board of Dental Examiners 1 507 Airport Blvd.,Suite 105,Morrisville,NC 27560 1 Tel:919.878.8223 I Fax:919.678.8472
http://www.ncdentalboard.org/searchresult.asp 5/13/2014
NPI Registry Provider Details Page 1 of 2
R,� NPPES
A146orW Plan&ProviderEnumarabbn Syskm Home Help
Back to Results
The information for the Provider you selected is displayed.The NPI Registry data was last updated on 05/12/2014.
NOTE: Some health care providers reported their SSNs or IRS ITINs in sections of the NPI application that
contain information that is required to be disclosed under FOIA. For example, a provider may have reported an
SSN or an IRS ITIN as an"Other Provider Identification Number"or as a"License Number".To protect the
privacy of these individuals,we have made every attempt to locate and remove those SSNs and IRS ITINs from
being displayed in the information provided below.
Provider Information:
Name: DR. MENG MONICA MENG DDS
Gender: FEMALE
Sole Proprietor: NO
NPI Information:
NPI: 1942435979
Entity Type: 1-INDIVIDUAL
Enumeration Date: 05/19/2009
Last Update Date: 05/19/2009
Replacement NPI:
Deactivation Date:
Reactivation Date:
Provider Business Mailing Address:
Address: 121 S ESTES DR SUITE 206
CHAPEL HILL, NC 27514-2868
Phone Number: 9199333310
Fax Number:
Provider Business Practice Location Address:
Address: 121 S ESTES DR SUITE 206
CHAPEL HILL, NC 27514-2868
Phone Number: 9199333310
Fax Number:
Provider Taxonomy:
Primary Selected Taxonomy State License
Taxonomy Number
YES 122300000X-DENTIST NC 8771
https://npiregistry.cros.hhs.gov/NPPESRegistry/NPIRegistrySearch.do 5/13/2014
NCTracks Operations Center
P.O.Box 300009
Raleigh, NC 27622-8009
05/17/2014
ORANGE COUNTY HEALTH DEPT
300 W TRYON ST
HILLSBOROUGH,NC 27278-2438
NPI/Atypical Provider ID: 1942435979
Re: Affiliation to your Organization
Dear ORANGE COUNTY HEALTH DEPT,
This letter serves to notify you that the provider below has been added to NCTracks with an affiliation to
your organization:
Affiliated Provider's NPI/Atypical ID: 1942435979
Provider Name:MENG MONICA MENG
Effective Date: 05/16/2014
If you have questions regarding this notice,please contact the NCTracks Operations Center at
800-688-6696 or email the NCTracks Operations Center at NCTracksprovider @nctracks.com.
Sincerely,
NCTracks Operations Center
For certified/overnight mail only
NCTracks Operations Center 12610 Wycliff Road,Suite 102 1 Raleigh,NC 27607-3073
p+1.600.688.6696 I f+ 1.855.710.1965 1 www.nctracks.nc.gov
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement("Agreement") is made effective the first day of July, 2014,
by and between Orange County Government through its Orange County Health Department ("Covered
Entity"), and Monica Meng-Haggerty, DDS, ("Business Associate"). Covered Entity and Business
Associate may be referred herein individually as a "Party" or collectively as the "Parties". This
Agreement supersedes any previously executed Business Associate Agreement between the Parties.
WITNESSETH:
WHEREAS, Sections 261 through 264 of the federal Health Insurance Portability and
Accountability Act of 1996 ("HIPAA"), Public Law 104-191, as modified by the Health Information
Technology for Economic and Clinical Health Act ("HITECH"), Public Law 111-5, known as "the
Administrative Simplification provisions," direct the Department of Health and Human Services to
develop standards to protect the security, confidentiality and integrity of health information; and
WHEREAS, pursuant to the Administrative Simplification provisions, the Secretary of Health and
Human Services ("Secretary") has issued regulations modifying the Privacy, Security, Breach
Notification, and Enforcement Rules at 45 CFR Parts 160 and 164, as the same may be amended from
time to time(the"HIPAA Security and Privacy Rule"); and
WHEREAS, the Parties wish to enter into or have entered into an arrangement whereby Business
Associate will provide certain services to Covered Entity, and, pursuant to such arrangements, Business
Associate may be considered a"Business Associate"of Covered Entity as defined in the HIPAA Security
and Privacy Rule (the agreement evidencing such arrangement is detailed below and hereinafter referred
to as the"Service Agreement(s)"); and
WHEREAS, Business Associate may have access to Protected Health Information (as defined below) in
fulfilling its responsibilities under such arrangement;
THEREFORE, in consideration of the Parties' continuing obligations under the Service Agreement,
compliance with the HIPAA Security and Privacy Rule, and other good and valuable consideration, the
receipt and sufficiency of which is hereby acknowledged, the Parties agree to the provisions of this
Agreement in order to address the requirements of the HIPAA Security and Privacy Rule and to protect
the interests of both Parties.
I. DEFINITIONS
(a) Service Agreement. Agreement(s) for services affected by this HIPAA Business
Associate Agreement, which this Business Associate Agreement shall be attached to, and is (are) hereby
incorporated by reference, and which shall be taken and considered as a part of this document the same as
if fully set out herein:
M. Monica Meng-Haggerty,DDS
(b) Catch-all Provision. Except as otherwise defined herein, any and all capitalized terms in
this Agreement shall have the definitions set forth in the HIPAA Security and Privacy Rule,45 CFR Parts
160 and 164, subparts A and E. In the event of an inconsistency between the provisions of this Agreement
and mandatory provisions of the HIPAA Security and Privacy Rule,as amended,the HIPAA Security and
Privacy Rule shall control. Where provisions of this Agreement are different than those mandated in the
HIPAA Security and Privacy Rule, but are nonetheless permitted by the HIPAA Security and Privacy
Rule,the provisions of this Agreement shall control.
1
October 2013
(c) Electronic Protected Health Information. Protected Health Information that is transmitted
by or maintained in Electronic Media(as defined in the H1PAA Security and Privacy Rule).
(d) Protected Health Information. "Protected Health Information" shall have the same
meaning as the term in 45 CFR § 160.103, limited to the information created or received by Business
Associate from or on behalf of Covered Entity and includes without limitation "Electronic Protected
Health Information." Business Associate acknowledges and agrees that all Protected Health Information
that is created or received by Covered Entity and disclosed or made available in any form, including paper
record, oral communication, audio recording, and electronic display by Covered Entity or its operating
units to Business Associate or is created or received by Business Associate on Covered Entity's behalf
shall be subject to this Agreement.
(e) Required by Law. "Required by Law" shall have the same meaning as the term in 45
CFR§ 164.103.
II. OBLIGATIONS AND ACTIVITIES OF BUSINESS ASSOCIATE
(a) Use and Disclosure. Business Associate agrees to fully comply with the requirements
under the HIPPA Security and Privacy Rule applicable to Business Associates and not to use or disclose
Protected Health Information other than as permitted or required by this Agreement, the Service
Agreement or as Required by Law. To the extent Business Associate carries out obligations of Covered
Entity under the HIPAA Security and Privacy Rule, Business Associate shall comply with the applicable
provisions of the HIPAA Security and Privacy Rule as if such use or disclosure were made by Covered
Entity. Business Associate agrees to comply with Covered Entity's policies regarding the minimum
necessary use or disclosure of Protected Health Information.
(b) Appropriate Safeguards. Business Associate agrees to use appropriate safeguards to
prevent use or disclosure of Protected Health Information other than as provided for by this Service
Agreement(s), this Agreement or as Required by Law. This includes the implementation physical,
technical and administrative safeguards to prevent use or disclosure of Protected Health Information other
than as permitted in this Agreement or Required by Law and reasonably and appropriately protect the
confidentiality, integrity, and availability of any Electronic Protected Health Information that it creates,
receives, maintains, or transmits on behalf of Covered Entity as required by the HIPAA Security and
Privacy Rule. The Business Associate shall maintain appropriate documentation of its compliance with
the HIPPA Security and Privacy Rule, including, but not limited to, its policies, procedures, records of
training and sanctions of members in its workforce.
(c) Assurances. Business Associate agrees to provide Covered Entity with written
assurances that any Protected Health Information placed on any type of mobile media, including, but by
no means limited to, lap top computers, Ipads and mobile phones, is encrypted in accordance with
guidance issued by the Secretary.
(d) Agents and Subcontractors. Business Associate shall require any agents, including any
subcontractors, to whom it provides Protected Health Information from Covered Entity that is created,
received, maintained or transmitted on behalf of Business Associate to agree by written contract with
Business Associate to the same (or greater) restrictions, conditions and requirements that apply to
Business Associate with respect to such information, and to agree to implement reasonable and
appropriate safeguards to protect any of such information that is Electronic Protected Health Information.
In addition, Business Associate agrees to take reasonable steps to ensure that its employees' actions or
omissions do not cause Business Associate to breach the terms of this Agreement.
(e) Mitigation of Breach. Business Associate agrees to mitigate, to the extent practicable,
any harmful effect that is known to Business Associate of a use or disclosure of Protected Health
2
October 2013
Information by Business Associate in violation of the requirements of this Agreement, as well as to
provide complete cooperation to Covered Entity should Covered Entity elect to review or investigate such
noncompliance or Security Incident. Business Associate shall cooperate in Covered Entity's breach
analysis and/or risk assessment, if requested. Furthermore, Business Associate shall cooperate with
Covered Entity in the event that Covered Entity determines that any third parties must be notified of a
Breach,provided that Business Associate shall not provide any such notification except at the direction of
Covered Entity.
(f) Breach Reporting. Business Associate shall report in writing to Covered Entity's Privacy
Officer (see Exhibit A), any use or disclosure of Protected Health Information that is not in compliance
with the terms of this Agreement, as well as any Security Incident and any actual or suspected Breach, of
which it becomes aware, without unreasonable delay, and in no event later than forty-eight(48)hours of
such discovery. For purposes of this Agreement, "Security Incident" means the attempted or successful
unauthorized access, use, disclosure, modification, or destruction of information or interference with
system operations in an information system. Such notification shall contain the elements required by 45
C.F.R. § 164.410.
(g) Compliance. To the extent applicable, Business Associate will comply with (i) Covered
Entity's Notice of Privacy Practices; (ii) any limitations to which Covered Entity has agreed in regard to
an Individual's permission to use or disclose his or her Protected Health Information; and (iii) any
restrictions to the use or disclosure of Protected Health Information to which Covered Entity has agreed
or is required to agree.
(h) Government Access. Business Associate will make its internal practices, books and
records available to the Secretary of the Department of Health and Human Services for purposes of
determining compliance with the terms of the HIPAA Security and Privacy Rule, and, at the request of
the Secretary, will comply with any investigations and compliance reviews, permit access to information,
and cooperate with any complaints, as Required by Law. Without unreasonable delay and, in any event,
no more than 48 hours of receipt of the request or notification, Business Associate will notify Covered
Entity in writing of any request by any governmental entity, or its designee, to review Business
assessment of any kind.
(i) Electronic Transactions. If Business Associate conducts any Standard Transactions for or
on behalf of Covered Entity, Business Associate shall comply with the requirements under the Electronic
Transaction Rule.
0) Audit. Business Associate shall permit Covered Entity, in its discretion, to conduct an
audit of Business Associate's compliance with this Agreement, HIPAA, and HITECH. Such audit may
consist of an onsite visit, a series of inquiries that require written responses, or both. Business Associate
shall promptly and completely respond to Covered Entity's requests for information in support of the
audit, which shall not be conducted more than once annually except in cases of an actual or reasonably
suspected Security Incident or reasonably suspected noncompliance with this Agreement, HIPAA or
HITECH. Each Party shall bear its own costs associated with the audit.
(k) Identity Theft. Business Associate shall implement Identity Theft Monitoring Policies
and Procedures to protect any patient information that may be breached by the Business Associate to the
extent applicable under the Federal Trade Commission's Red Flag Rules.
(1) HITECH Compliance. Business Associate shall:
A. Not receive, directly or indirectly, any impermissible remuneration in exchange
for Protected Health Information or Electronic Protected Health Information,
except as permitted by HITECH§ 13405(d)or the H1PPA Regulations;
3
October 2013
B. Comply with the marketing and other restrictions applicable to Business
Associates contained in HITECH § 13406 and the HIPPA Regulations;
C. To the extent required under HITECH § 13404, fully comply with the applicable
requirements of 45 CFR 164.502(e)(2) for each use and disclosure of Protected
Health Information;
D. To the extent required under HITECH § 13401, fully comply with 45 CFR §§
164.308, 164.310, 164.312,and 164.316;
E. To the extent required under HITECH §§13401 and 13404, comply with the
additional privacy and security requirements that apply to Covered Entities in the
same manner and to the same extent as Covered Entity is required to do so; and
F. To the extent required under the HIPPA Regulations, comply with the privacy
and security requirements that apply to Business Associates.
(m) State Privacy Laws. Business Associate shall understand and comply with state privacy
laws to the extent that such privacy laws are not preempted by HIPPA or HITECH.
III. PERMITTED USES AND DISCLOSURES BY BUSINESS ASSOCIATE
(a) Use of Protected Health Information on Behalf of Covered Entity. Except as otherwise
limited in this Agreement, Business Associate may use or disclose Protected Health Information to
perform functions, activities or services for, or on behalf of, Covered Entity described in the Service
Agreement, provided that such use or disclosure would not violate the HIPPA Security and Privacy Rule
if it were made by Covered Entity or would not violate the Covered Entities minimum necessary policies.
(b) Other Uses of Protected Health Information. Except as otherwise limited in this
Agreement, Business Associate may use Protected Health Information within its workforce for the proper
management and administration of Business Associate not to include Marketing or Commercial Use and
to carry out the legal responsibilities of Business Associate; and
(c) Third Party Confidentiality. Except as otherwise limited in this Agreement, Business
Associate may disclose Protected Health Information for the proper management and administration of
Business Associate or to carry out the legal responsibilities of Business Associate, provided that if
Business Associate discloses any Protected Health Information to a third party for such purpose, the
Business Associate shall enter into a written agreement with such third party requiring the following:
A. Disclosure only as Required by Law;or
B. Business Associate obtains reasonable assurances from the person to whom the
information is disclosed that the information will remain confidential and will be used or
further disclosed only as Required by Law or for the purpose for which it was disclosed
to the person, and the person notifies Business Associate of any instances of which it is
aware in which the confidentiality, integrity, and or availability of the Protected Health
Information has been breached immediately upon becoming aware.
(d) Business Associate may provide data aggregation services relating to the health care
operations of Covered Entity pursuant to any agreements between the Parties evidencing their business
relationship as permitted by 45 CFR§ 164.504(e)(2)(i)(B).
(e) Other Uses Strictly Limited. Nothing in this Agreement shall permit the Business
Associate to share Protected Health Information with Business Associate's affiliates or contractors except
4
October 2013
for the purposes of the Service Agreement(s) between the Covered Entity and Business Associate(s)
identified in Section I(a)of this Agreement.
(f) Covered Entity Authorization for Additional Uses. Any use of Protected Health
Information by Business Associate, its affiliate or Contractor, other than those purposes of this
Agreement, shall require express written authorization by the Covered Entity, and a Business Associate
Agreement or amendment as necessary. Activities which are prohibited include, but are not limited to,
Marketing, as defined by 45 CFR§ 164.503 or the sharing for Commercial Use or any purpose construed
by Covered Entity as Marketing or Commercial Use, even if such sharing would be permitted by federal
or state laws.
(g) Business Associate may de-identify Protected Health Information only at the specific
direction of and only for the use of Covered Entity. Business Associate may not sell Protected Health
Information except at the direction of Covered Entity and in compliance with the requirements of the
HIPAA Security and Privacy Rule.
IV. AVAILABILITY OF PHI
(a) Access to Protected Health Information. Business Associate agrees, in the event the
Business Associate maintains protected health information in a Designated Record Set,to make available,
within ten (10) days of a request by Covered Entity in a time and manner designated by Covered Entity,
Protected Health Information in a Designated Record Set, to Covered Entity or as directed by Covered
Entity, to an individual in order to meet the requirements of 45 CFR § 164.524 of the HIPAA Security
and Privacy Rule.
(b) Amendments to Protected Health Information. In the event that the Business Associate
maintains Protected Health Information in a Designated Record Set, Business Associate agrees to make
any amendment(s) to Protected Health Information in a designated record set that the Covered Entity
directs or agrees to pursuant to the HIPAA Security and Privacy Rule at the request of Covered Entity of
an individual,within ten(10)days of receipt of a request from Covered Entity and in the time and manner
designated by Covered Entity.
(c) Accounting of Disclosures. Business Associate agrees to maintain and make available
the information required to provide an accounting of disclosures, as required by 45 CFR§ 164.528 of the
HIPAA Security and Privacy Rule. Business Associate will comply with Covered Entity's policy
regarding accounting of disclosures.
(d) Document Disclosures. In the event an Individual makes a request under this Section of
the Agreement directly to Business Associate, Business Associate will notify Covered Entity of such
request within three (3) business days and shall cooperate with, and act only at the direction of Covered
Entity in responding to such request.
V. OBLIGATIONS OF COVERED ENTITY
(a) Notice of Privacy Practices. Covered Entity shall provide Business Associate with the
notice of privacy practice that Covered Entity produces in accordance with 45 CFR § 164.520, as well as
any changes to that notice.
(b) Notice of Changes in Individual's Access or Protected Health Information. Covered
Entity shall provide Business Associate with any changes in, or revocation of, permission by an
Individual to use or disclose Protected Health Information, is such changes affect Business Associate's
permitted or required uses.
5
October 2013
(c) Notice of Restriction in Individual's'Access to Protected Health Information. Covered
Entity shall notify Business Associate of any restrictions to the use or disclosure of Protected Health
Information that Covered Entity has agreed in accordance with 45 CFR § 164.522 to the extent that such
restriction may affect Business Associate's use of Protected Health Information.
VI. PERMISSABLE REQUESTS BY COVERED ENTITY
Requests Permissible Under HIPAA. Covered Entity shall not request Business Associate to use
or disclose Protected Health Information in any manner that would not be permissible under the Privacy
or Security Rule.
VII. TERMINATION
(a) Term. This Agreement shall be effective as of the date first set forth above and shall
terminate upon the earlier of (i) the termination of all agreements between the parties, and (ii) the
termination by Covered Entity for cause as provided herein.
(b) Termination for Cause. Notwithstanding anything in this Agreement to the contrary,
Covered Entity shall have the right to terminate this Agreement and the Service Agreement immediately
if Covered Entity determines that Business Associate has or will violated any material term of this
Agreement. Upon Covered Entity's knowledge of a material breach by Business Associate, Covered
Entity shall provide an opportunity for Business Associate to cure the breach or end the violation.
Covered Entity may terminate this Agreement if Business Associate does not cure the breach or end the
violation within the time period specified by Covered Entity. If termination, cure or end of the violation
is not feasible,Covered Entity may report the violation to the Secretary.
(c) Obligation of Business Associate Upon Termination. At termination of this Agreement,
the Service Agreement(or any similar documentation of the business relationship of the Parties), or upon
request of Covered Entity,whichever occurs first,Business Associate, shall:
A. if feasible,return(in a manner or process approved by the Covered Entity)or destroy
all Protected Health Information, regardless of form, including but not limited to
paper or electronic format, received from Covered Entity, or created, maintained or
received by Business Associate on behalf of Covered Entity. Business Associate
shall retain no copies of the Protected Health Information. This provision shall also
apply to Protected Health Information and other confidential information in the
possession of sub-contractors or agents of Business Associate.
B. If such return or destruction is not feasible, Business Associate shall (i) retain only
that Protected Health Information necessary for Business Associate to continue its
proper management and administration or to carry out its legal responsibilities; (ii)
return or destroy the remaining Protected Health Information that the Business
Associate still maintains in any form; (iii)extend the protections of this Agreement to
the retained Protected Health Information; (iv) limit further uses and disclosures to
those purposes that make the return or destruction of the Protected Health
Information not feasible; and (v) return or destroy the retained Protected Health
Information when it is no longer needed by Business Associate.
(d) Survival. This paragraph shall survive the termination of this Agreement and shall apply
to Protected Health Information created, maintained, or received by Business Associate and any of its
subcontractors.
VIII. MISCELLANEOUS
6
October 2013
(a) Indemnification. Business Associate agrees to indemnify, defend, and hold harmless
Covered Entity, its officers, agents, contractors and agents, against, and in respect of, any and all claims,
losses, expenses, costs, damages, obligations, penalties, and liabilities which Covered Entity may incur
by reason of Business Associate's breach of or failure to perform any its obligations pursuant to this
Agreement, including but not limited to any injury or damages arising from any noncompliance with this
Agreement or any Security Incident attributable to the negligence of Business Associate, including
failure to execute the terms of this Agreement. Further,Business Associate agrees to indemnify, defend,
and hold harmless Covered Entity, its officers, employees, contractors and agents, against all costs and
expenses, including but not limited to, reasonable legal expenses, which are incurred by or on behalf of
Business Associate in connection with the defense of such claims.
(b) Disclaimer. Covered Entity makes no warranty or representation that compliance by
Business Associate with this Agreement,HIPAA, HITECH, or the HIPAA Regulations will be adequate
or satisfactory for Business Associate's own purposes. Business Associate is solely responsible for all
decisions made by Business Associate regarding the safeguarding of Protected Health Information.
(c) Assistance in Litigation or Administrative Proceedings. Business Associate shall make
itself, and any subcontractors, employees, affiliates or agents assisting Business Associate in the
performance of its obligations under this Agreement, available to Covered Entity, at no cost to Covered
Entity,to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being
commenced against Covered Entity, its directors, officers or employees based upon a claimed violation
of HIPAA, HITECH, the HIPAA Regulations, or other laws relating to security and privacy, except
where Business Associate or its subcontractor,employee or agent is named adverse party.
(d) Survival. The obligations of Business Associate under this Agreement shall survive the
expiration, termination, or cancellation of this Agreement, the Service Agreement and/or the business
relationship of the parties, and shall continue to bind Business Associate, its agents, employees,
contractors, successors, and assigns as set forth herein.
(e) Ownership of Information. Covered Entity holds all right, title, and interest in and to the
Protected Health Information and Business Associate does not hold and will not acquire by virtue of this
Agreement or by virtue of providing goods or services to Covered Entity, any right,title, or interest in or
to the PHI or any portion thereof.
(f) Right to Injunctive Relief. Business Associate expressly acknowledges and agrees that
the breach, or threatened breach,by it of any provision of this Agreement may cause Covered Entity to be
irreparably harmed and that Covered Entity may not have an adequate remedy at law. Therefore,Business
Associate agrees that upon such breach, or threatened breach, Covered Entity will be entitled to seek
injunctive relief to prevent Business Associate from commencing or continuing any action constituting
such breach without having to post a bond or other security and without having to prove the inadequacy
of any other available remedies. Nothing in this paragraph will be deemed to limit or abridge any other
remedy available to Covered Entity at law or in equity. Except as expressly stated herein or in the HIPAA
Security and Privacy Rule, the parties to this Agreement do not intend to create any rights in any third
parties.
(g) Amendment. The Parties agree to take such action as is necessary to amend this
Agreement from time to time as is necessary for Covered Entity to comply with the requirements of the
HIPSS Regulations. In addition, this Agreement may be amended or modified by the Parties only in
writing.
(h) Assignment. No Party may assign its respective rights and obligations under this
Agreement without the prior written consent of the other Party.
7
October 2013
(i) Independent Contractor. None of the provisions of this Agreement are intended to create,
nor will they be deemed to create any relationship between the Parties other than that of independent
parties contracting with each other solely for the purposes of effecting the provisions of this Agreement
and any other agreements between the Parties evidencing their business relationship. This Agreement
will be governed by the laws of the State of North Carolina. No change, waiver or discharge of any
liability or obligation hereunder on any one or more occasions shall be deemed a waiver of performance
of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other
occasion.
0) Regulatory References. A reference in this Agreement to a section in HIPAA, HITECH
or the HIPAA Regulations means the section as it currently is in effect or as amended.
(k) Interpretation. Any ambiguity in this Agreement shall be resolved in favor of a meaning
that permits Covered Entity to comply with the HIPAA Regulations. The parties agree that, in the event
that any documentation of the arrangement pursuant to which Business Associate provides services to
Covered Entity contains provisions relating to the use or disclosure of Protected Health Information that
are more restrictive than the provisions of this Agreement, the more restrictive provisions will control.
The provisions of this Agreement are intended to establish the minimum requirements regarding Business
Associate's use and disclosure of Protected Health Information.
(1) Severability. In the event any part or parts of this Agreement are held to be
unenforceable, the remainder of this Agreement will continue in effect. In addition, in the event a party
believes in good faith that any provision of this Agreement fails to comply with the then-current
requirements of the HIPAA Security and Privacy Rule, such party shall notify the other party in writing.
For a period of up to (30) thirty days, the parties shall address in good faith such concern and amend the
terms of this Agreement, if necessary to bring it into compliance. If, after such thirty-day period, a party
believes in good faith that the Agreement fails to comply with the HIPAA Security and Privacy Rule,
then either party has the right to terminate upon written notice to the other party.
(m) Notices and Communications. All instructions, notices, consents, demands, or other
communications required or contemplated by this Agreement shall be in writing and shall be delivered to
the Party at the address below:
For Covered Entity: For Business Associate
Orange County Heath Department
ATTN: Carla Julian
300 West Tryon Street
Hillsborough NC,27278
(n) Strict compliance. No failure by any Party to insist upon strict compliance with any
terms or provisions of this Agreement,to exercise any option,to enforce any right, or to seek any remedy
upon any default of any other Party shall affect, or constitute a waiver of, any Party's right to insist upon
such strict compliance, exercise that option, enforce that right, or seek that remedy with respect to that
default or any prior, or contemporaneous, or subsequent default. No custom or practice of the Parties at
variance with any provisions of this Agreement shall affect, or constitute a waiver of, any Party's right to
demand strict compliance with all provisions of this Agreement.
(o) Governing Law. This Agreement shall be governed and construed in accordance with the
laws of the State of North Carolina except to the extent that North Carolina laws have been pre-empted by
HIPAA and without giving effect to principals of conflicts of law. Jurisdiction shall be Orange County,
North Carolina, for purposes of litigation resulting from disagreements of the Parties for purposes of this
Agreement and the Service Agreement(s).
(p) E-Verify. Employers and their subcontractors with 25 or more employees as defined in
Article 2 of Chapter 64 of the NC General Statutes must comply with E-Verify requirements to contract
8
October 2013
with governmental units. E-Verify is a Federal program operated by the United States Department of
Homeland Security and other federal agencies, or any successor or equivalent program used to verify the
work authorization of newly hired employees pursuant to federal law. Where applicable, failure to
maintain compliance with the requirements of Article 2 of Chapter 64 of the North Carolina General
Statutes shall constitute breach of this Agreement. If applicable, by executing this Agreement, Business
Associate affirms that they are in compliance with Article 3 of Chapter 64 if the North Carolina General
Statutes.
IN WITNESS WHEREOF, the Parties have executed this Agreement as of the day and year written
above.
COVERED ENTITY: BUSINESS ASSOCIATE:
By: By:04 ;gm
Title: fff�^ gt het -.! /1 iflcfA Title: , , A DOS
9
October 2013
EXHIBIT A
COVERED ENTITY PRIVACY OFFICER CONTACT INFORMATION
To report to Covered Entity any use or disclosure of Protected Health Information not in compliance with
the terms of this Agreement that might be considered a privacy breach,Business Associate should contact
the Privacy Officer at the applicable entity. To report to Covered Entity any Security Incident(as defined
in the Agreement),Business Associate should contact Carla Julian 919-245-2040,or the Security
Officer at The Orange County Health Department.
10
October 2013