Loading...
06/20/2007 Agreement 11...11111. Circuft c.n Danny L. Kolhage - Office (305) 295.3130 Fax (305) 295-3663 Memnrandum To: Deb Barsell, Director Community Services Attn: Sandy Molina Isabel C. DeSantis, ~ Deputy Clerk From: Date: Monday, July 02, 2007 At the BOCC meeting held on June 20, 2007, the Board approved the following: Business Associate/Qualified Service Organization Agreement between Monroe County and Guidance Clinic of the Middle Keys (GCMK) to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and 42 CFR Part 2 of the Federal Register; Monroe County agrees to provide referral services to GCMK. Attached hereto is a duplicate original of the subject document for your handling. Should you have any questions concerning the above, please do not hesitate to contact this office. cc: Finance County Attorney File BUSINESS ASSOCIATE IQUALlFIED SERVICE ORGANIZATION AGREEMENT (BAlQSO Agreement) This Agreement is made effective the _ 20th_ day of .June_, 2007 _ by and bel\veen the Guidance Clinic of the Middle Keys, Inc., hereinafter referred to as the "Clinic", and _Monroe County Social Services hereinafter referred to as "Business Associate". The Business Associate agrees to provide the Clinic with the following services: Referral Services WITNESSETH: WHEREAS, Sections 261 through 264 of the Federal Health Insurance Portabililty and Accountability Act of 1996, Public Law 104-191 ,known as "the Administrative Simplification provisions," direct the Department of Health and Human Services to develop standards to protect the security, confidentiality and integrity of health information; and Pursuant to the Administrative Simplification provisions, the Secretary of Health and Human Services has issued regulations modifying 45 CFR Parts 142, 160, 162, and 164 (the "HIPAA Privacy Rule") and, pursuant to 42 CFR Part 2 which sets forth the federal regulations governing the Confidentiality of Alcohol and Drug Abuse Patient Records, The Business Associate may have access to Protected information (as defined below) in fulfilling its responsibilities under such an agreement. In consideration of the Parties' continuing obligations for compliance with the HIPAA Privacy Rule and 42 CFR Part 2, which prohibits disclosure of any PHI as defined below except as permitted or defined by law, and to protect the interests of both Parties, the Parties agree to the provisions of this Agreement. I. DEFINITIONS Except as otherwise defined herein, any and all capitalized terms in this Section shall have the definitions set forth in the HIPAA Privacy Rule and 42 CFR Part 2. In the event of an inconsistency between the provisions of this Agreement and mandatolry provisions of the HIPAA Privacy Rule, as amended, the HIPAA Privacy Ftule shall control except as provided in 42 CFR Part 2 . Where provisions of this Agreement are different from those mandated in the HIPAA Privacy Ftule, but are nonetheless permitted by the HIPAA Privacy Rule, the provisions of this Agreement shall control. The term "protected information" means individually identifiable information including" without limitation, all information, data, documentation, and materials, including without limitation, demographic, medical and financial information, that relates to the past, present, or future physical or mental health or condition of an individual; the provision of health care to an individual; or the past, present, or future payment for the provision of health care to an individual; and that identifies the individual or with respect to which there is a reasonable basis to believe the information can be used to identify the individual. Furthermore, the Business Associate: acknowledges that in receiving, transmitting, transporting, storing, processing, or otherwise dealing with any information created by or received from the Clinic identifying or otherwise relating to the clients of the Clinic (protected information) is fully bound by the provisions of the Federal regulations, 42 C.F.R. Part 2 and 45 C.F.R. Parts 160 and 164 and may not use or disclosure the information except as permitted or required by this Agreement or by law: II. CONFIDENTIALITY REQUIREMENTS (A) Business Associate agrees: (i) to use or disclose any Protected information solely: (1) for meeting its obligations as set forth in any agreements between the Parties evidencing their business relationship or (2) as required by applicable law, rule or regulation, or by accrediting or licensing organizations to whom the Clinic is required to disclose such information or as otherwise permitted under this Agreement, or the HIPAA Privacy Rule and 42 CFR Part 2, and (3) as would be permitted by the HIPAA Privacy Rule and 42 CFR Part 2 if such use or disclosure were made by the Clinic; (ii) to make available its internal practices, books, and records, including policies and procedures, relating to the use and disclosure of protected information received from the Clinic, or created or received by the Business Associate on behalf of the Clinic, to the Clinic or to the Secretary of the Department of Health and Human Services for purposes of the Secretary determining the Clinic's compliance with HIPAA; (iii) to ensure that its agents, including subcontractors, to whom it provides protected Information received from or created by Business Associate on behalf of Clinic, agrees to the same restrictions and conditions that apply to the Business Associate with respect to such information. In addition, the Business Associate agrees to take reasonable steps to ensure that its employees' actions or omissions do not cause Business Associate to breach the terms of this Agreement. (iv) to document disclosures of protected information, and information related to such disclosures, as would be required for the program to BA.QSO Agreement Revised 3.07 respond to a request by an individual or an accounting of disclosures in accordance with 45 C.F.R. Section 164.528. (v) to resist any efforts in judicial proceedings to obtain access to the protected information except as expressly provided for in the regulations governing the Confidentiality of Alcohol and Drug Abuse Client Records, 42 CFR Part 2. (vi) to use appropriate safeguards to prevent the unauthorized use or disclosure of the protected information. In addition, the Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to the Business Associate of a use or disclosure of protected information by the Business Associate in violation of the requirements of this Agreement. (vii) to report to the Clinic any use or disclosure of the protected information not provided for by this Agreement of which it becomes aware. (viii) to provide access to the protected information at the request of the Clinic or to an individual as directed by the Clinic in order to meet the requirements of 45 C.F.R. Part 164.524 which provides clients with the right to access and copy their own protected information. (ix) to make amendments to the protected information as directed or agreed to by the Clinic pursuant to 45 C.F.R. art 164.526. (x) to provide the Clinic or an individual in accordance to this agreement to permit the Clinic to respond to a request by an individual for an accounting of disclosures in accordance with 45 C.F.R. 164.528. (xi) at termination of this Agreement, the Agreement (or any similar documentation of the business relationship of the Parties), or upon request of Clinic, whichever occurs first, if feasible, the Business Associate will return or destroy all protected information received from or created or received by the Business Associate on behalf of Clinic that Business Associate still maintains in any form and retain no copies of such information. The Business Associate shali retain any copies of the protected information. If such return or destruction is not feasible, the Business Associate will extend the protections of this Agreement to the information and limit further uses and disclosures to those purposes that make the return or destruction of the information not feasible. This provision shall apply to protected information that is in the possession of subcontractors of the Business Associate. (B) Notwithstanding the prohibitions set forth in this Agreement, Business Associate may use and disclose protected information as follows: BA.QSO Agreement Revised 3.07 (i) If necessary, for the proper management and administration of the Business Associate or to carry out the legal responsibilities of Business Associate, provided that as to any such disclosure, the following requirements are met: (a) The disclosure is required by law; or (b) Business Associate obtains reasonable assurances from the pierson to whom the information is disclosed that it will be held confidentially and used or further disclosed only as required by law or for the purpose for which it was disclosed to the person, and the person notifies Business Associate of any instances of which it is aware in which the confidentiality of the information has been breached; (Ii) for data aggregation services, if to be provided by Business Associate for the health care operations of Clinic pursuant to any agreements between the Parties evidencing their business relationship. For purposes of this Agreement, data aggregation services means the combining of protected information by Business Associate with the protected information received by Business Associate in its capacity as a business associate of another covered entity, to permit data analyses that relate to the health care operations of the respective covered entities. III. TERMINATION Notwithstanding anything in this Agreement to the contrary, Clinic shall have the right to terminate this Agreement immediately if Clinic determines that Business Associatl3 has violated any material term of this Agreement. If Clinic reasonably believes that Business Associate will violate a material term of this Agreement and, where practicable, Clinic gives written notice to Business Associate of such belief within a reasonable time after forming such belief, and Business Associate fails to provide adequate written assurances to Clinic that it will not breach the cited term of this Agreement within a reasonable period of time given the specific circumstances, but in any event, before the threatened breach is to occur, then Clinic shall have the right to terminate this Agreement immediately. IV. M!SCELLANEOUS Except as expressly stated herein or the HIPM Privacy Rule or 42 CFR Part 2, the parties to this Agreement do not intend to create any rights in any third parties. The obligations of Business Associate under this Section shall survive the expiration, termination, or cancellation of this Agreement, the Arrangement Agreement and/or the business relationship of the parties, and shall continue to bind Business Associate, its agents, employees, contractors, successors, and assigns as set forth herein. This Agreement may be amended or modified only in a writing signed by the Parties. No Party may assign its respective rights and obligations under this Agreement without the prior written consent of the other Party. None of the BA.QSO Agreement Revised 3.07 provisions of this Agreement are intended to create, nor will they be deemed to create any relationship between the Parties other than that of independent parties Gontracting with each other solely for the purposes of effecting the provisions of this Agreement and any other agreements between the Parties evidencing their business relationship. This Agreement will be governed by the laws of the State of Florida. No change, waiver or discharge of any liability or obligation hereunder on anyone or more occasions shall be deemed a waiver of performance of any continuing or other obligation, or shall prohibit enforcement of any obligation, on any other occasion. The parties agree that, in the event that any documentation of the arrangement pursuant to which Business Associate provides services to Clinic contains provisions relating to the use or disclosure of protected information which are more restrictive than the provisions of this Agreement, the provisions of the more restrictive documentation will control. The provisions of this Agreement are intended to establish the minimum requirements regarding Business Associate's use and disclosure of Protected Health Information. In the event that any provision of this Agreement is held by a court of competent jurisdictiion to be invalid or unenforceable, the remainder of the provisions of this Agreement will remain in full force and effect. In addition, in the event a party believes in good faith that any provision of this Agreement fails to comply with the then-current requirements of the HIPAA Privacy Rule and/or 42 CFR Part 2, such party shall notify the other party in writing. For a period of up to thirty days, the parties shall address in good faith such concern and amend the terms of this Agreement, if necessary to bring it into compliance. If, after such thirty-day period, the Agreement fails to comply with the HIPAA Privacy Rule and/or 42 CFR Part 2, then either party has the right to terminate upon written notice to the other party. IN WITNESS WHEREOF, the Parties have executed this Agreement as of the day and year written above. CLINIC: ~~". By: O~OrO!E~, FL N~"e a d Title Name and Title MAY R MARIO Iro,,~~ ::'i 3000 41st St. Ocean Marathon FL 33050 1100 Simonton Street,Key ~~,- FLr:,330@ Address Address '-,-,0,,:":::J ....-. !..J ___ ---1\-,"'. _:; :-~J :-<:-1::':::: - "1 Date: 4/"11/07 Date: ~ /'2.. 0 /0 7 ;2]' ~~ ~ r; , I.)> J '. :0 ~ U \:.>::~A1.; :"'fJ:::tJc~ECLER~~ -':"'J'iCLE~' MONROE COUNTY ATTORNEY A~~TO~r: YNTHIA L. HALL ASS~T COUNTY ATTORNEY Date J..4. 1 I, a. 00 ':J . BA.QSO Agreement Revised 3.07