HomeMy WebLinkAbout5496Contract Number: 5496
Vendor: KITSAP MENTAL HEALTH SERVICES
Subject: HIPPA Business Association Agreement
Department: Court
File Class: GS50-01-11 Rev. 3 General
Begin Date: 4/13/2015
End Date:
Review Date:
Vault Date:
Comments :
�
HIPAA Business Associate Agreement
Between the City of Bremerton and Kitsap Mental Health Services
This agreement is executed to ensure that Kitsap Mental Health Services ("Contractor")
will appropriately safeguard protected health information ("PHI") that is created, received,
maintained, or transmitted on behalf of City of Bremerton in compliance with the applicable
provisions of Chapter 70.02 RCW, the Uniform Health Care Information Act ("UHCIA") as
amended, with Public Law 104-191 of August 21, 1996, known as the Health Insurance
Portability and Accountability Act of 1996, Subtitle F— Administrative Simplification, Sections
261 etseq. ("HIPAA") as amended, and with Public Law 111-5 of February 17, 2009, known as
the American Recovery and Reinvestment Act of 2009, Title XII, Subtitle D— Privacy, Sections
13400 et seq., the Health Information Technology and Clinical Health Act (the "HITECH Act") as
amended.
A. General Provisions
1. Meanin� of Terms. The terms used in this Addendum shall have the same meaning
as those terms defined in the UHCIA and HIPAA. Where definitions in the two Acts
differ, UHCIA definitions shall control.
2. Re�ulatory References. Any reference in this Addendum to a regulatory section
means the section currently in effect or as amended.
3. Interpretation. Any ambiguity in this Addendum shall be interpreted to permit
compliance with the UHCIA and HIPAA.
B. Obligations of Business Associate
Contractor agrees that it will:
1. Not use or further disclose PHI other than as permitted or required by this
Addendum or as required by law;
2. Use appropriate safeguards and comply, where applicable, with UHCIA security
safeguards and the HIPAA Security Rule with respect to electronic protected health
information ("e-PHI") and implement appropriate physical, technical and
administrative safeguards to prevent use or disclosure of PHI other than as provided
for by this Addendum;
3. Report to City of Bremerton any use or disclosure of PHI not provided for by this
Addendum of which it becomes aware, including any security incident (as defined in
the HIPAA Security Rule) and any breaches of unsecured PHI as required by 45 CFR
§164.410. Breaches of unsecured PHI shall be reported to City of Bremerton
v
without unreasonable delay but in no case later than 60 days after discovery of the
breach;
4. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any
subcontractors that create, receive, maintain, or transmit PHI on behalf of
Contractor agree to the same restrictions, conditions, and requirements that apply
to Contractor with respect to such information;
5. Make PHI in a designated record set available to City of Bremerton and to an
individual who has a right of access in a manner that satisfies City of Bremerton's
obligations to provide access to PHI in accordance with RCW 70.02.080 and 45 CFR
§164.524, as promptly as required under the circumstances, but no later than 15
working days after receiving a request;
6. Make any amendment(s) to PHI in a designated record set as directed by City of
Bremerton, or take other measures necessary to satisfy City of Bremerton's
obligations under RCW 70.02.100 and 45 CFR §164.526, as promptly as required
under the circumstances, but no later than 10 days after receiving a request;
7. Maintain and make available information required to provide an accounting of
disclosures to City of Bremerton or an individual who has a right to an accounting
within 60 days and as necessary to satisfy City of Bremerton's obligations under
RCW 70.02.020 and 45 CFR §164.528;
8. To the extent that Contractor is to carry out any of City of Bremerton's obligations
under the UHCIA and HIPAA, Contractor shall comply with the requirements of the
Acts that apply to City of Bremerton when it carries out that obligation;
9. Make its internal practices, books, and records relating to the use and disclosure of PHI
received from, or created or received by Contractor on behalf of City of Bremerton,
available to the Secretary of the Department of Health and Human Services for
purposes of determining Contractor and City of Bremerton's compliance with HIPAA
and the HITECH Act; �
10. Restrict the use or disclosure of PHI if City of Bremerton notifies Contractor of any
restriction on the use or disclosure of PHI that City of Bremerton has agreed to or is
required to abide by under the UHCIA or 45 CFR §164.522; and
11. City of Bremerton may be subject to the Red Flags Rules (found at 16 CFR §681.1 et
seq.) and in relation thereto has adopted an Identity Theft Prevention Program
(Resolution No. 3081). Contractor agrees to assist City of Bremerton in complying
with its Program and the Red Flags Rules by: (a) implementing policies and
procedures to detect relevant Red Flags (as defined under 16 C.F.R. §681.2); (b)
taking all steps necessary to comply with the policies and procedures of City of
2
:-
Bremerton's Identity Theft Prevention Program; (c) ensuring that any agent or third
party who performs services on its behalf in connection with covered accounts of
City of Bremerton agrees to implement reasonable policies and procedures designed
to detect, prevent, and mitigate the risk of identity theft; and (d) alerting City of
Bremerton of any Red Flag incident (as defined by the Red Flags Rules) of which it
becomes aware, and the steps it has taken to mitigate any potential harm that may
have occurred, and providing a report to City of Bremerton of any threat of identity
theft as a result of the incident.
12. Comply with all current rules and regulations pertaining to the OIG Compliance
Program for ambulance suppliers and any current special bulletins regarding LEIE
recommended screening of employees and any subcontractors.
C. Permitted Uses and Disclosures by Business Associate
The specific uses and disclosures of PHI that may be made by Contractor on behalf of
City of Bremerton include:
1. The review of patient care information for providing advice to City of Bremerton
concerning a particular ambulance incident;
2. The review of patient care information and other medical records and submission of
that information to carriers, insurers, and other payers and assisting City of
Bremerton in an insurance or Medicare audit or other similar action; and
3. Other uses or disclosures of PHI as permitted by the UHCIA or HIPAA necessary to
perform the services that Contractor has been engaged to perform on behalf of City
of Bremerton.
D. Termination
City of Bremerton may terminate the Agreement if City of Bremerton determines
that Contractor has violated a material term of the Addendum.
2. If either party knows of a pattern of activity or practice of the other party that
constitutes a material breach or violation of the other party's obligations under this
Addendum, that party shall take reasonable steps to cure the breach or end the
violation, as applicable, and, if such steps are unsuccessful, terminate the
Agreement, if feasible.
3. Upon termination of the Agreement for any reason, Contractor shall return to City of
Bremerton or destroy all PHI received from City of Bremerton, or created,
maintained, or received by Contractor on behalf of City of Bremerton that
Contractor still maintains in any form. Contractor shall retain no copies of the PHI. If
. . -_.�
return or destruction is infeasible, the protections of this Addendum will extend to
such PHI.
Agreed to this 13th day of April, 2015.
City of Bremerton
Signature: J, �2G�(�//�.-
Title: Me icalOfficer
Date: 13 April 2015
.NC � �1=y �� �' 1.�� `��,lA'��
i � tr� •-� .
` v°��
�:°;��� L �
p ,�.,-r�,
(� a f
`A..1i �'4 "9:.,.�.'4 f'
Kitsap Mental Health
Signature:
Title:
Date: G�'�/ S � z o 1 S
4