HIPAA Business Associate Agreement

Parties to this Agreement

Recitals

WHEREAS, CE has engaged BA to provide certain services ("Services") as described in the underlying service agreement;

WHEREAS, in connection with the provision of Services, BA may create, receive, maintain, or transmit Protected Health Information (as defined below) on behalf of CE;

WHEREAS, CE and BA intend to protect the privacy and provide for the security of Protected Health Information in compliance with HIPAA, HITECH Act, and regulations promulgated thereunder;

NOW THEREFORE, in consideration of the mutual obligations set forth herein, the parties agree as follows:

1. Definitions

Terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in 45 CFR §§ 160.103, 164.103, 164.304, 164.501 and 164.502.

1.1 Specific Definitions:

• "Breach" shall have the meaning given to such term under 45 CFR § 164.402.
• "Business Associate" shall have the meaning given to such term under 45 CFR § 160.103.
• "Covered Entity" shall have the meaning given to such term under 45 CFR § 160.103.
• "Data Aggregation" shall have the meaning given to such term under 45 CFR § 164.501.
• "Designated Record Set" shall have the meaning given to such term under 45 CFR § 164.501.
• "Electronic Protected Health Information" or "ePHI" means Protected Health Information that is created, received, maintained or transmitted in electronic media.
• "Individual" shall have the meaning given to such term under 45 CFR § 160.103.
• "Minimum Necessary" shall mean the least amount of Protected Health Information necessary to accomplish the purpose of the use, disclosure, or request.
• "Protected Health Information" or "PHI" shall have the meaning given to such term under 45 CFR § 160.103.
• "Required by Law" shall have the meaning given to such term under 45 CFR § 164.501.
• "Secretary" shall mean the Secretary of the U.S. Department of Health and Human Services or his/her designee.
• "Security Incident" shall have the meaning given to such term under 45 CFR § 164.304.
• "Subcontractor" shall mean a person or entity to whom Business Associate delegates a function, activity, or service.
• "Unsecured Protected Health Information" shall have the meaning given to such term under 45 CFR § 164.402.

2. Obligations and Activities of Business Associate

2.1 General Obligations

Business Associate agrees to:

• Not use or disclose PHI other than as permitted or required by this Agreement or as Required by Law;
• Use appropriate safeguards, and comply with Subpart C of 45 CFR Part 164 with respect to ePHI, to prevent use or disclosure of PHI other than as provided for by this Agreement;
• Report to CE any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including Breaches of Unsecured PHI as required by 45 CFR § 164.410;
• In accordance with 45 CFR § 164.502(e)(1)(ii) and 164.308(b)(2), ensure that any Subcontractors that create, receive, maintain, or transmit PHI on behalf of BA agree to the same restrictions, conditions, and requirements that apply to BA with respect to such information;
• Maintain and make available PHI in a Designated Record Set to CE as necessary to satisfy CE's obligations under 45 CFR § 164.524;
• Make any amendment(s) to PHI in a Designated Record Set as directed or agreed to by CE pursuant to 45 CFR § 164.526;
• Maintain and make available the information required to provide an accounting of disclosures to CE as necessary to satisfy CE's obligations under 45 CFR § 164.528;
• Make its internal practices, books, and records available to the Secretary for purposes of determining compliance with HIPAA Rules;
• To the extent BA is to carry out one or more of CE's obligations under Subpart E of 45 CFR Part 164, comply with the requirements of Subpart E that apply to CE in the performance of such obligations.

2.2 Security Obligations

Business Associate agrees to:

• Implement administrative, physical, and technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and availability of ePHI;
• Ensure that any agent or Subcontractor to whom it provides ePHI agrees to implement reasonable and appropriate safeguards;
• Report to CE any Security Incident of which it becomes aware;
• Implement procedures to regularly review records of information system activity;
• Implement procedures for creating and maintaining retrievable exact copies of ePHI;
• Implement encryption and decryption mechanisms for ePHI.

2.3 Breach Notification

Business Associate shall:

• Notify CE without unreasonable delay and in no case later than sixty (60) days after discovery of a Breach of Unsecured PHI;
• Such notification shall include:
  • The identification of each Individual whose Unsecured PHI has been breached;
  • A description of what happened, including date of Breach and discovery;
  • A description of the types of Unsecured PHI involved;
  • A description of the investigation and mitigation actions taken;
  • Contact information for Individuals to ask questions.

3. Permitted Uses and Disclosures by Business Associate

3.1 General Use and Disclosure Provisions

BA may only use or disclose PHI:

• As necessary to perform Services for CE;
• As Required by Law;
• For the proper management and administration of BA or to carry out legal responsibilities of BA;
• For Data Aggregation purposes for the health care operations of CE;
• To report violations of law to appropriate Federal and State authorities.

3.2 Minimum Necessary

BA agrees to make uses and disclosures and requests for PHI consistent with CE's minimum necessary policies and procedures.

3.3 De-identification

BA may de-identify PHI in accordance with 45 CFR § 164.514(a)-(c), provided that CE approves the method of de-identification.

4. Obligations of Covered Entity

CE shall:

• Notify BA of any limitation(s) in the notice of privacy practices of CE to the extent that such limitation may affect BA's use or disclosure of PHI;
• Notify BA of any changes in, or revocation of, permission by an Individual to use or disclose PHI;
• Notify BA of any restriction on the use or disclosure of PHI that CE has agreed to or is required to abide by;
• Not request BA to use or disclose PHI in any manner that would not be permissible under Subpart E of 45 CFR Part 164 if done by CE.

5. Term and Termination

5.1 Term

This Agreement shall be effective as of the date of execution and shall terminate on the date that the underlying service agreement terminates or on the date CE terminates for cause as authorized in paragraph 5.2, whichever is sooner.

5.2 Termination for Cause

CE may terminate this Agreement upon thirty (30) days' written notice to BA if CE determines BA has violated a material term of this Agreement and BA has not cured the breach within the thirty (30) day period.

5.3 Effect of Termination

• Upon termination, BA shall return or destroy all PHI received from CE, or created or received by BA on behalf of CE. This provision shall apply to PHI that is in the possession of Subcontractors of BA;
• If BA determines that returning or destroying PHI is not feasible, BA shall provide CE notification of the conditions that make return or destruction not feasible and shall extend the protections of this Agreement to such PHI.

6. Indemnification

BA shall indemnify, defend, and hold harmless CE, its officers, directors, employees, and agents from and against all claims, liabilities, costs, and expenses (including reasonable attorneys' fees) arising out of or relating to BA's breach of this Agreement or violation of HIPAA Rules.

7. Amendment

The parties acknowledge that state and federal laws relating to electronic data security and privacy are rapidly evolving. The parties agree to take such action as is necessary to implement the standards and requirements of HIPAA, HITECH Act, and other applicable laws. Upon the request of either party, the parties agree to promptly enter into negotiations concerning an amendment to this Agreement.

8. Survival

The respective rights and obligations of BA under Section 5.3 of this Agreement shall survive the termination of this Agreement.

9. Interpretation

Any ambiguity in this Agreement shall be interpreted to permit compliance with HIPAA Rules. In the event of an inconsistency between the provisions of this Agreement and mandatory provisions of HIPAA Rules, as amended, the HIPAA Rules shall control.

10. Regulatory References

A reference in this Agreement to a section in HIPAA Rules means the section as in effect or as amended.

Agreement Acknowledgment

By using My Clinical Writer services, you acknowledge that you have read, understood, and agree to be bound by this Business Associate Agreement.