HomeMy WebLinkAbout5567 . � � ��'�'� 55�� �
. ,� PQninsula
Community
Health
Services
Business Associate Agreement
Thls Buslness Associate Agreement("Agreement"),is entered Into as of the effective
date described on the 5lgnature Page of this Agreement{the"Effective Date")between City of
Bremerton with an address at 911 Park Ave,Bremerton WA 98337("Business Associate")and
Peninsula Comrnunity Heafth Services,with an address at PO Box 960,Bremerton,WA 98337
("Cavered �ntity"j (each a"Party"and coilectively the"Parties"�.
Recital
7he Partfes have entered into a prior agreement entitted Apr1125`�'2016 dated(the
"Under(ying Agreement"). Performance of the Underiyfng Agreement may lnvoive Protected
Health Information("PH{")(as de#ined in d�5 CFR§164.501)that Is subject to the federal privacy
and security regulations issued pursuant to the Health insurance Portabflity and Accountabflity
Act of 1996("HlPAA")and the regutations promulgated thereunder by the United States
Department of Health and Human Services("HHS"J,codEfied at 45 CFR Parts 160 and 164
(commonly known as the Privacy and Security Rules),(cotlectively referred to hereln as the
"HIPAA Rules"). 7he purpose of this Agreement Is to set forth the abligatians of the Parties
with respect to such PHI.
Agreement
in consideratlon af the mutual promises below and the exchange of information
pursuant to this Agreement,the partfes agree as follows:
1. Definitions.
A. Protected eaft Infor ation or PHI. "Protected Nealth Informatlon"ar"PHI"
shall have the same mean(ng as the term Protected Nealth Information"in 45 CFR§160.203,
limited to the information created or recelved by Business Assoclate on behalf of ar from
Covered Entity. PHI will include PHI In electronic form("Electronic PNI")unless speclfically
stated otherwlse.
B. 7erms used but not otherwise deflned in this Agreement shall have the same
meaning as given to those terms in the Health information Portability and Accountability Act of �
1996,as codified at 42 USC§132Qd("HIPAA"),the Health Informatlan Technolagy Act of 2009,
as codified at 42 USCA prec.§17901("HI7ECH"�,and any current and future regufations
pramulgated under etther(HIPAA, Hi7ECH,and any regutations collectively,the"l.aw and
Regulatlons").
ll. Business Assoclate's Obii at�.
A. Refatfonship of Parties. In providing these services,Business Associate wlll be I
acting as an independent contractor and not as an employee or agent of Covered Entlty.
1
�
�
I
�
I _ �
Covered Entity shall have no authority,express or implied,to commit or obligate Business
Associate in any manner whatsoever.
B, No Permitted Use or Dlscfosure of PHI. Business Associate shal)not use ar
dfsciose PHl other than as permitted or required by the Agreement or as Required By Law.
C. Safe�uards. Business Associate shall use appropriate safeguards,and cornply
with Subpart C af 45 CFR Rart 164 wlth respect to Electronic PHI,to prevent use or disclosure of
PHi other than as pravided for by the Agreement.
D. Not�ce to Covered Entit : Business Associate agrees to report to Covered Entity
any use or disclosure of PHI not pravtded for(n the Agreement,any Securiry Incident involving
electronlc PNI,and any Breach of Unsecured PHI as required at 45 CFR 164.410. Such report
shall be pravided promptly and without unreasonable delay,but no later than fifteen(15)days �
after Business Associate first learns of the unautharized use or disclosure,Security Incident or
Breach. '
E. 5ubcontractors. If the Covered Entlty permits Business Associate to subcontract �
its duties, Business Associate agrees ta ensure that any Subcuntractors that creats,recelve, �
maintain,or transmit PH!on behalf af the Business Associate agree to the same restrictions,
condltions,and requirements that apply to the Business Associate with respect to such
information,in accordance with 45 CFR§§164.502(e)(1)(il)and 164.308tb)(2).
F, Access to PHI. To the extent that Business Associate possesses an appllcable
besfgnated Record Set,and within a reasonabte amount of time of receipt of a request from
Covered Entity or Individual to access such PHI, Business Associate shatl make avaitabfe such
PWI,to the extent required for Covered �ntit�s compliance with Its obligatlons under 45 CFR
§164.524.
G. Amendment of PHI. To the extent that Business Associate possesses an
applicable Designated Record Set,and with(n a reasonable amount of time of rece(pt of a
request from Covered Entity or Indtvidual, Business Assoctate sfiall rnake any amendment(s}to
such PHI as directed or agreed to by the Covered Entity pursuant to 45 CFR§264.526,or take
other measures as necessary to satlsfy covered entity's obligations under�45 C�R�164.526.
H. Accountfn�. Business Associate shali document and make available such
disclosures of PHI as would be requlred for Covered Entity to respond to a request by an
lndividual for an accounting of disclosures of PHi in accordance wfth 45 C�R§164.528.
I. Compliance with Covered Entitv Obli�ations.To the extent the Business
Associate is to carry out one or more of Covered Entity's obiigation(s) under Subpart E of 45 CFR
Part 164, Business Associate shai)comply w(th the requlrements of Subpart E that apply to the
Covered Entity in the performance of such obligation(s).
1, Availabilitv af Comnliance Records. Business Associate sha41 make its Internal
practices,books,and records availa6le to the Setretary for purposes of determining compliance
with the HiPAA Rules. Notwithstanding this provision,no attorney-cilent or other appllcable
fegal prlvilege will be deemed walved by Covered Entity as a result of complying with such a
2
�
{
�
I
request. Business Assoclate sha11 promptiy provide Cavered Entity with a copy of any PHi that
Business Associate provides pursuant to any governmentat inquiry.
K. Miti�ation. Business Assoclate shall mitigate,to the extent practicabte and at its
cost,any harmful effects from any use or disclosure nf PHI by Bustness Associate not permitted
by thls Agreement,regardless of Business Associate's fault or negligence. Al)such efforts shall
be subJect to the Covered Ent(ty's prior written approval.
l.. Prohibition on Certain Uses and Disclosures. Business Associate shall not use or
disclose PHI for any purpose other than as specifically permitted by this Agreement.
Specifically, but without Ilmitation, Business Associate shall not use or dfsclose PHI for
fundraising or marketing purposes,and shal!not directly or indirectly recelve remuneration in
exchange for PHI(whfch does not affect payment from Covered Entity for Business Associate's
services}.
lll. Permitted Use and Disclosure of PHI.
A. Business Associate may only use or disclose PHI as necessary to perform its
obligations and functions under the Underlying Agreement;
B, Busfness Associate rnay use flr dfsclose PHI as Required By I..aw;
C. 8usiness Associate may use PNJ to create de-identlfled informatlon consistent
w9th the standards of 45 CFR§164.514(a)-(c).
D. Business Associate agrees to make uses and dlsclosures and requ�sts for PHl
consistent with Covered Entlty's min(mum necessary poficfes and procedures
1. Business Associate may not use or disclose PHI in a manner that wouid
violate Subpart E af 4S CFR Part 164 if dane by Covered Entity.
IV. Terrn and Termination.
A. Term. 7his Agreement shall become effective on the date of executfon of the
Under{ying Agreement, and shaU terminate at the tlme of the termination or expiratlon af all
tlnderlying Agreements.
B. Termination for Cause. if Covered Entity reasonably determines that Business
Associate has mater�ally breached this Agreement,Covered Entity shall:
1, Provide Business Assoctate with ten(10)days written notice of the alleged
material breach and an opportunity to cure the breach, immedlately after which time this
Agreement and the Services Agreement shall be automat)cally terminated if the breach is not
cured;ar
2. immediately terminate this Agreernent and the Services Agreement if cure is
not passlbte;or
3, Report the violatton to the Secretary if neither termination nor cure is
feasible.
C. Termination for Chan�e in Law. ff a change in law causes the periormance of the
Agreement to violate the law, Business Associate and/or Cavered Entity shall terminate this
Agreement if cure is not possible. �
3
, ` f
. �
. � �
D. Effect of Termination. �
1. Upon termination of this Agreement for any reasan,Business Associate shail:
a. Retain onty that PHf whlch is necessary for Business Associate to continue
Its proper management and administration or to carry out its legal
responsibilfties;
b. At Covered £ntlty's apilon,return to Covered Entity or destroy the
remaining PHI that the Business Associate still maintains in any form;
c. Continue to use appropriate safeguards and comply with Subpart C of 4S
CFR Part 164 with respect to Electronic PHI to prevent use or disclosure
of the PHI,other than as provided for in this Section,for as long as
Business Associate retalns the PHI;
d. Not use or disclose the PH1 retained by Business Associate oiher than for
the purposes for which such PHI was retalned and subject to the same
conditEans set out in this Agreement which applied prior to terminatton;
and
e. At Covered Entity's optton,return to Covered Entity or destroy the PHI �
retained by Business Associate when it is no longer needed by Business
Associate for its proper management and admfnistration or to carry out
its tegal responslbilities.
2. If requested by Covered Entity,Busfness Assocfate wii!transmit the PHI to
another business assoctate of the Cavered Entity at termination.
3. Survlval. The obligatians of Business Associate under this Section shall
survive the termination of this Agreement.
V. Indemnification and Insurance.
Business Associate will defend and Indemnify Covered Entity from and against any and
a!I claims,damages,IEabilities,losses and expenses(including reasonable attorney's fees)based
on or aris{ng out of the breach of its obligatlons under this Agreement, incfuding but not limited
to losses and damages relating to third party claims. If Covered Entity requEres, Business
Associate shall obtain and maintain insurance coverage(if avaifable)agalnst improper uses and
disclosures of PHI by Business Associata, naming Covered Entity as an additfonal insured.
Promptly following Cavered Entlty's wrltten request, Business Associate shall deliver to Cavered
�ntity a certiFlcate evidencing�usiness Associate's malntenance of such (nsurance.
V!. Miscelianeous.
A. Re�ufatorv References, A reference in this Agreement to a section in the MtPAA
Rules means the section as In effect as of the effective date of the Agreement or as amended in
the future.
B. Amendments. 7he Agreement may nat be modif(ed,nar shall any provis}an
hereof be waived or amended,except in a writing duly slgned by authorized representative of
the Parties. The Parties shali amend this Agreement from time to t(me as is necessary to
4
�
�
I
. �
achieve and malntain compliance with the requirements of the HIPAA Rules and ahy ather
applicable iaw.
C. Interpretatlon. Any amblgufty in this Agreement shall be resolved to perm{t the
Parties to comply with the requirements of the H1PAA Rules and any other applicable taw.
D. Cholce aF I.aw. This Agreement shall be governed by the laws of the State of ,
Washington without regard to conflict of laws principles thereaf. �
E. Audits lnspection and Enforcement. Upon request and wlth reasonable prior �
notice b Covered Entit Business AssocEate and 1ts agents shall atlow Covered Entfty ta I
Y Y,
conduct a reasonable inspectlon of the facllities,systems,books,records,agreements,policies
and procedures refating to the use or disclosure of PHI pursuant to this Agreement or for the
purpose of determin9ng whether Buslness Associate is In compilance w(th its obligations under
this Agreement.
F. Relationshiq to Aereements with Covered Entitv. In the event that a provision of
this Agreement is cantrary tn a provis9on of any agreement with Covered Entity pertafning to
Bustness Associate's servlces,the provisfons of this Agreement shaN controi.
IN WITNESS WHEREOF,the parties have executed this Agreement as of the 25�'day of
Aprll,2016.
City of Bremerton Peninsula Community liealth Services
�
gy �� . By
Title ' � �t-�����_ Tit . �� �
5
I
�
I
l