HomeMy WebLinkAbout5497Contract Number: 5497
Vendor: KITSAP COUNTY EMERGENCY MEDICAL AND TRAUMA SYSTEM
Subject: HIPPA Business Association Agreement
Department: Fire
File Class: GS50-01-11 Rev. 3 General
Begin Date: 3/30/2015
End Date:
Review Date:
Vault Date:
Comments :
..,
HIP� �usiness Associate Agreement
Between the City of Breme�ton and I{itsap County Emergency Medical and Trauma
System
This agreement is executed to ensure that Kitsap County Emergency Medical and
Trauma System ("Contractor") will appropriately safeguard protected health information
("PHI") that is created, received, maintained, or transmitted on behalf of City of Bremerton in
compliance with the applicable provisions of Chapter 70.02 RCW, the Uniform Health Care
Information Act ("UHCIA") as amended, with Public Law 104-191 of August 21, 1996, known as
the Health Insurance Portability and Accountability Act of 1996, Subtitle F— Administrative
Simplification, Sections 261 etseq. ("HIPAA") as amended, and with Public Law 111-5 of
February 17, 2009, known as the American Recovery and Reinvestment Act of 2009, Title XII,
Subtitle D— Privacy, Sections 13400 et seq., the Health Information Technology and Clinical
Heafth Act (the "HITECH Act") as amended.
A. General Provisions
1. Meanin� of Terms. The terms used in this Addendum shall have the same meaning
as those terms defined in the UHCIA and HIPAA. Where definitions in the two Acts
differ, UHCIA definitions shall control.
2. Re�ulatorv References. Any reference in this Addendum to a regulatory section
means the section currently in effect or as amended.
3. Interpretation. Any ambiguity in this Addendum shall be interpreted to permit
compliance with the UHCIA and HIPAA.
6. Obligations of Business Associate
Contractor agrees that it will:
1. Not use or further disclose PHI other than as permitted or required by this
Addendum or as required by law;
2. Use appropriate safeguards and comply, where applicable, with UHCIA security
safeguards and the HIPAASecurity Rule with respect to electronic protected health
information ("e-PHI") and implement appropriate physical, technical and
administrative safeguards to prevent use or disclosure of PHI other than as provided
for by this Addendum; ,
3. Report to City of Bremerton any use or disclosure of PHI not provided for by this
Addendum of which it becomes aware, including any security incideni (as defiined in
±he HIPAA Security Rule) and any breaches of unsecured PNI as required by 45 CFR
§164.410. Breaches of unsecured PHI shall be reported to City of Bremerton
-.
without unreasonable delay but in no case later than 60 days after discovery of the
breach;
4. In accordance with 45 CFR 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any
subcontractors that create, receive, maintain, or transmit PHI on behalf of
Contractor agree to the same restrictions, conditions, and requirements that apply
to Contractor with respect to such information;
5. Make PHI in a designated record set available to City of Bremerton and to an
individual who has a right of access in a manner that satisfies City of Bremerton's
obligations to provide access to PHI in accordance with RCW 70.02.080 and 45 CFR
§164.524, as promptly as required under the circumstances, but no later than 15
workirg �ays afte� receiving a re�u�st;
6. Make any amendment(s) to PHI in a designated record set as directed by City of
Bremerton, or take other measures necessary to satisfy City of Bremerton's
obligations under RCW 70.02.100 and 45 CFR §164.526, as promptly as required
under the circumstances, but no later than 10 days after receiving a request;
7. Maintain and make available information required to provide an accounting of
disclosures to City of Bremerton or an individual who has a right to an accounting
within 60 days and as necessary to sat;sfy City of Bremerton's obligations under
RCW 70.02.020 and 45 CFR §164.528;
8. To the extent that Contractor is to carry out any of City of Bremerton's abligations
under the UHCIA and HIPAA, Contractor shall comply with the requirements of the
Acts that apply to City of Bremerton when it carries out that obligation;
9. Make its internal practices, books, and records relating to the use and disclosure of PHI
received from, or created or received by Contractor on behalf of City of Bremerton,
available to the Secretary of the Department of Health and Human Services for
purposes of detPrmining Contractor and City of Bremerton's compliance with HIPAA
and the HITECH Act;
10. Restrict the use or disclosure of PHI if City of Bremerton notifies Contractor of any
restriction on the use or disclosure of PHI that City of Bremerton has agreed to or is
required to abide by under the UHCIA or 45 CFR §164.522; and
11. City of Bremerton may be subject to the Red Flags Rules (found at 16 CFR §681.1 et
seq.) and in relation thereto has adopted an Identity Theft Prevention Program
(Resolution No. 3081). Contractor agrees to assist City of Bremerton in complying
with its Program and the Red Flags Rules by: (a) implementing policies and
procedures to detect relevant Red Flags (as defined under 16 C.F.R. §681.2); (b)
taking all steps necessarv to complv with the policies and orocedures of City of
2
Bremerton's Identity Theft Prevention Program; (c) ensuring that any agent or third
party who performs services on its behalf in connection with covered accounts of
City of Bremerton agrees to implement reasonable policies and procedures designed
to detect, prevent, and mitigate the risk of identity theft; and (d) alerting City of
Bremerton of any Red Flag incident (as defined by the Red Flags Rules) of which it
becomes aware, and the steps it has taken to mitigate any potential harm that may
have occurred, and providing a report to City of Bremerton of any threat of identity
theft as a result of the incident.
12. Comply with all current rules and regulations pertaining to the OIG Compliance
Program for ambulance suppliers and any current special bulletins regarding LEIE
recommended screening of employees and any subcontractors.
C. Permitted Uses and Disclosures by Business Associate
The specific uses and disclosures of PHI that may be made by Contractor on behalf of
City of Bremerton include:
The review of patient care information for providing advice to City of Bremerton
concerning a particular ambulance incident;
The review of patient care information and other medical records and submission of
that information to carriers, insurers, and other payers and assisting City of
Bremerton in an insurance or Medicare audit or other similar action; and
3. Other uses or disclosures of PHI as permitted by the UHCIA or HIPAA necessary to
perform the services thai Contractor has been engaged fo perr'orm un uef�alf oi �iiy
of Bremerton.
D. Termination
1. City of Bremerton may terminate the Agreement if City of Bremerton determines
that Contractor has violated a material term of the Addendum.
2. If either party knows of a pattern uf activity or practice of the other party that
constitutes a material breach or violation of the other party's obligations under this
Addendum, that party shall take reasonable steps to cure the breach or end the
violation, as applicable, and, if such steps are unsuccessful, terminate the
Agreement, if feasible.
3. Upon termination of the Agreement for any reason, Contractor shall return to City of
Bremerton or destroy all NHI received from City of Bremerton, or created,
maintained, or received �y C�ntractor on behalf of City of Bremerton that
Contractor still maintains in any form. Contractor shall retain no copies of the PHI. If
3
�
return or destruction is infeasible, the protections of this Addendum will extend to
such PHI.
Agreed to this 30th day of March, 2015.
City of Bremert Kitsap County Emergency Medical and Trauma System
Signature: Signature: �
Title: f eF�le�-7- Title: S(��� � G�-- �
Date: -S �' �� Date: �' r��( S
�..
�
�