Item C13BOARD OF COUNTY COMMISSIONERS
AGENDA ITEM SUMMARY
Meeting Date: June 19, 2013
Bulk Item: Yes X No
Division: Employee Services
Department: Employee Benefits
Staff Contact Person/Phone #: Maria Gonzalez, Ext. 4448
AGENDA ITEM WORDING: Approval of a Business Associate Agreement between the Monroe
County Board of County Commissioners and Gallagher Benefit Services as mandated by the Privacy
Rule promulgated under the Administrative Simplifications subtitle of the Health Insurance Portability
and Accountability of 1996 (HIPAA) including all pertinent regulations issued by the U.S. Department
of Health and Human Services as outlined in 45 C.F.R. Parts 160, 162 and 164 (HIPAA Privacy Rules
and Security Standards), including as amended by the Health Information Technology for Economic and
Clinical Health Act as set forth in Title XIII of Division A and Title IV of Division B of the American
Recovery and Reinvestment Act of 2009 (HITECH Act).
ITEM BACKGROUND: Current agreement renewed at April 17, 2013 meeting for one year with the
option to renew up to two additional years.
PREVIOUS RELEVANT BOCC ACTION: 2010 RFP done and September 15, 2010 the BOCC
approved the Gallagher Benefit Services bid and entered into an agreement for three years.
CONTRACT/AGREEMENT CHANGES: N/A
STAFF RECOMMENDATIONS:
Approval
TOTAL COST: $129.000 r. INDIRECT COST: BUDGETED: Yes X No
DIFFERENTIAL OF LOCAL PREFERENCE:
COST TO COUNTY: $129,000 r-
REVENUE PRODUCING: Yes No
APPROVED BY: County AttyU ,
DOCUMENTATION: Included
DISPOSITION:
Revised 7/09
SOURCE OF FUNDS: Primarily Ad Valorem
AMOUNT PER MONTH Year
6
OMB/Purchasing
Not Required
Risk Management
AGENDA ITEM #
County of Monroe
The Florida Keys
Office of the Employee Services Division Director
The Historic Gato Cigar Factory
1100 Simonton Street, Suite 268
Key West, FL 33040
(305) 292-WB — Phone
(305) 2924564 - Fax
j BOARD OF COUNTY COMMISSIONERS
rr y Mayor George Neugent, District 2
i:. Mayor Pro Tern, Heather Carruthers, District 3
Danny L. Kolhage, District 1
David Rice, District 4
Sylvia J. Murphy, District 5
TO: Board of County Commissioners
DATE: May 30, 2013
FROM: Teresa E. Aguiar,
Employee Services Director
SUBJ: Approval of Addendum to Contract - HIPAA
This item requests approval of an amendment to the existing contract between the County and
Gallagher Benefit Services (GBS). The Business Associate Addendum covers the period of
October 1, 2013 and shall continue until the Contract is terminated. The agreement outlines the
privacy rules and security standards that the County and GBS must follow regarding the disclosure
of protected health information as required by HIPAA.
There is no additional cost. The $129,000 per year is the cost of the services currently provided by
GBS as the County's Insurance Consultant. That contract was approved at the BOCC meeting on
April 17, 2013.
It is recommended that the BOCC approve the addition of the amendment to the current contract.
If you have any questions on this item, please do not hesitate to contact me at X4458.
MONROE COUNTY BOARD OF COUNTY COMMISSIONERS
CONTRACT SUMMARY
Contract #
Contract with: Gallagher Benefit Services Effective Date:October 1, 2013
Expiration Date:September 20, 2014
Contract Purpose/Description:Anproval of Business Associate Agreement between Monroe
County Board of County Commissioners and Gallagher Benefit Services
Contract Manager:Maria Gonzalez 4448 Employee Benefits
(Name) (Ext.) (Department)
for BOCC meeting on June 19, 2013 Agenda Deadline: June 4, 2013
CONTRACT COSTS
Total Dollar Value of Contract: $129,000 yr, Current Year Portion: $86,000
Budgeted? Yes® No ❑ Account Codes: 502-08001-530340-
Grant: $N/A
County Match: $N/A
ADDITIONAL COSTS
Estimated Ongoing Costs: $ /yr For:
(Not included in dollar value above) (eg. maintenance, utilities, janitorial, salaries, etc
CONTRACT REVIEW
Changes
Date Out
Division Director
at I Needed Revi er
15 Ye s❑ No6
�3
Risk Management
a ,t-
Yes❑ No[] �SG&
S-�3�60
O.M.B./Purchasing
5131113
Yes❑ NoE[ C
611 /i3
County Attorney
y
�� ��
Yes No
❑ d
��311)
Comments:
Vlv11J 1' V1111 1VGv1AGu 7/ 11171 IVI%lr ttL
BUSINESS ASSOCIATE AGREEMENT
This Business Associate Agreement ("Agreement") is entered into on this
day of (the "Effective Date"), by and between Monroe County Board of
County Commissioners on behalf of the Group Health Plan of Monroe Countv Board of
County Commissioners ("Covered Entity") and Gallagher Benefit Services, Inc. ("Business
Associate").
RECITALS:
WHEREAS, Covered Entity and Business Associate mutually desire to outline their
individual responsibilities with respect to the use and/or disclosure of Protected Health
Information ("PHI") as mandated by the Privacy Rule promulgated under the Administrative
Simplifications subtitle of the Health Insurance Portability and Accountability Act of 1996
("HIPAA") including all pertinent regulations issued by the U.S. Department of Health and
Human Services as outlined in 45 C.F.R. Parts 160, 162 and 164 ("HIPAA Privacy Rules and
Security Standards"), including as amended by the Health Information Technology for
Economic and Clinical Health Act as set forth in Title XIII of Division A and Title IV of
Division B of the American Recovery and Reinvestment Act of 2009 ("HITECH Act"); and
WHEREAS, Covered Entity and Business Associate understand and agree that the
HIPAA Privacy Rules and Security Standards require the Covered Entity and Business
Associate to enter into a Business Associate Agreement, which shall govern the use and/or
disclosure of PHI and the security of PHI and ePHI.
NOW, THEREFORE, the parties hereto agree as follows:
1. Definitions. When used in this Agreement and capitalized, the following
terms have the following meanings:
(a) "Breach" shall have the same meaning as the term "Breach" in 45
C.F.R. § 164.402.
(b) "Designated Record Set" shall have the meaning given such term in 45
C.F.R. § 164.501.
(c) "Electronic Protected Health Information" or "ePHI' shall mean
Protected Health Information transmitted by electronic media or maintained in
electronic media as defined in 45 C.F.R. § 160.103.
(d) "Individual" shall have the same meaning as the term "Individual" in
45 C.F.R. § 160.103 and shall include a person who qualifies as a personal
representative in accordance with 45 C.F.R. § 164.502(g).
(e) "Privacy Rule" shall mean the Standards for Privacy of Individually
Identifiable Health Information as set forth at 45 C.F.R. Part 160 and Part 164,
Subparts A and E.
BOSS>Mandatory Standards>Documents>Business Associate Agreement including Security 03-2013
(f) "Protected Health Information" or "PHI" shall have the same meaning
as the term "protected health information" in 45 C.F.R. § 160.103, limited to the
information created or received by Business Associate from or on behalf of Covered
Entity.
(g) "Required by Law" shall have the same meaning as the term "required
by law" in 45 C.F.R. § 164.103.
(h) "Secretary" shall mean the Secretary of the Department of Health and
Human Services or his or her designee.
(i) "Security Incident" shall mean any attempted or successful
unauthorized access, use, disclosure, modification or destruction of information or
interference with systems operations in an electronic information system, as defined in
45 C.F.R. § 164.304.
0) "Security Rule" shall mean the Standards for Security of PHI,
including ePHI, as set forth at 45 C.F.R. Part 160 and Part 164, Subparts A and C.
(k) "Unsecured Protected Health Information" shall mean protected
health information that is not rendered unusable, unreadable, or indecipherable to
unauthorized persons through the use of a technology or methodology specified by the
Secretary, as defined in 45 C.F.R. §§ 164.402 and 164.410.
Terms used but not defined in this Agreement shall have the same meaning as those
terms in the HIPAA regulations.
2. Obligations and Activities of Business Associate Regarding PHI.
(a) Business Associate agrees to not use or further disclose PHI other than
as permitted or required by this Agreement or as Required by Law.
(b) Business Associate agrees to use appropriate safeguards to prevent use
or disclosure of the PHI other than as provided for by this Agreement.
(c) Business Associate agrees to ensure that any agents, including sub-
contractors (excluding entities that are merely conduits), to whom it provides PHI
agree to the same restrictions and conditions that apply to Business Associate with
respect to such information.
(d) Business Associate agrees to provide access, at the request of Covered
Entity, and in a reasonable time and manner designated by Covered Entity, to PHI in a
Designated Record Set that is not also in Covered Entity's possession, to Covered
Entity in order for Covered Entity to meet the requirements under 45 C.F.R.
§ 164.524.
BOSS>Mandatory Standards>Documents>Business Associate Agreement including Security 03-2013
Page 2 of 9
(e) Business Associate agrees to make any amendment to PHI in a
Designated Record Set that the Covered Entity directs or agrees to pursuant to 45
C.F.R. § 164.526 in a reasonable time and manner designated by Covered Entity.
(f) Business Associate agrees to make internal practices books and records
relating to the use and disclosure of PHI available to the Secretary, in a reasonable
time and manner as designated by the Covered Entity or Secretary, for purposes of the
Secretary determining Covered Entity's compliance with the Privacy Rule. Business
Associate shall immediately notify Covered Entity upon receipt or notice of any
request by the Secretary to conduct an investigation with respect to PHI received from
the Covered Entity.
(g) Business Associate agrees to document any disclosures of PHI that are
not excepted under 45 C.F.R. § 164.528(a)(1) as would be required for Covered Entity
to respond to a request by an Individual for an accounting of disclosures of PHI in
accordance with 45 C.F.R. § 164.528.
(h) Business Associate agrees to provide to Covered Entity or an
Individual, in a time and manner designated by Covered Entity, information collected
in accordance with paragraph (g) above, to permit Covered Entity to respond to a
request by an Individual for an accounting of disclosures of PHI in accordance with 45
C.F.R. § 164.528.
(i) Business Associate agrees to use or disclose PHI pursuant to the
request of Covered Entity; provided, however, that Covered Entity shall not request
Business Associate to use or disclose PHI in any manner that would not be permissible
under the Privacy Rule if done by Covered Entity.
3. Permitted Uses and Disclosures of PHI by Business Associate.
(a) Business Associate may use or disclose PHI to perform functions,
activities or services for, or on behalf of, Covered Entity provided that such use or
disclosure would not violate the Privacy Rule if done by Covered Entity.
(b) Business Associate may use PHI for the proper management and
administration of Business Associate and to carry out the legal responsibilities of
Business Associate.
(c) Business Associate may disclose PHI for the proper management and
administration of Business Associate and to carry out the legal responsibilities of
Business Associate if-
(i) such disclosure is Required by Law, or
(ii) Business Associate obtains reasonable assurances from the person
to whom the information is disclosed that such information will remain
BOSS>Mandatory Standards>Documents>Business Associate Agreement including Security 03-2013
Page 3 of 9
confidential and used or further disclosed only as Required by Law or
for the purposes for which it was disclosed to the person, and the
person agrees to notify Business Associate of any instances of which it
is aware that the confidentiality of the information has been breached.
(d) Business Associate shall limit the PHI to the extent practicable, to the
limited data set or if needed by the Business Associate, to the minimum necessary to
accomplish the intended purpose of such use, disclosure or request subject to
exceptions set forth in the Privacy Rule.
(e) Business Associate may use PHI to provide Data Aggregation services
to Covered Entity as permitted by 45 C.F.R. § 164.504(e)(2)(i)(B).
4. Obligations of Covered Entity Regarding PHI.
(a) Covered Entity shall provide Business Associate with the notice of
privacy practices that Covered Entity produces in accordance with 45 C.F.R.
§ 164.520, as well as any changes to such notice.
(b) Covered Entity shall provide Business Associate with any changes in,
or revocation of, authorization by an Individual to use or disclose PHI, if such changes
affect Business Associate's permitted or required uses and disclosures.
(c) Covered Entity shall notify Business Associate of any restriction to the
use or disclosure of PHI that Covered Entity has agreed to in accordance with 45
C.F.R. § 164.522, if such restrictions affect Business Associate's permitted or required
uses and disclosures.
(d) Covered Entity shall require all of its employees, agents and
representatives to be appropriately informed of its legal obligations pursuant to this
Agreement and the Privacy Rule and Security Standards required by HIPAA and will
reasonably cooperate with Business Associate in the performance of the mutual
obligations under this Agreement.
5. Security of Protected Health Information
(a) Business Associate has implemented policies and procedures to ensure
that its receipt, maintenance, or transmission of all PHI, either electronic or otherwise,
on behalf of Covered Entity complies with the applicable administrative, physical, and
technical safeguards required protecting the confidentiality, availability and integrity
of PHI as required by the HIPAA Privacy Rules and Security Standards.
(b) Business Associate agrees that it will ensure that agents or
subcontractors agree to implement the applicable administrative, physical, and
technical safeguards required to protect the confidentiality, availability and integrity of
PHI as required by HIPAA Privacy Rules and Security Standards.
BOSS>Mandatory Standards>Documents>Business Associate Agreement including Security 03-2013
Page 4 of 9
(c) Business Associate agrees to report to Covered Entity any Security
Incident of which it becomes aware. Business Associate agrees to report the Security
Incident to the Covered Entity as soon as reasonably practicable, but not later than 10
business days from the date the Business Associate becomes aware of the incident.
(d) Business Associate agrees to establish procedures to mitigate, to the
extent possible, any harmful effect that is known to Business Associate of a use or
disclosure of PHI by Business Associate in violation of this Agreement.
(e) Business Associate agrees to immediately notify Covered Entity upon
discovery of any Breach of Unsecured Protected Health Information and provide to
Covered Entity, to the extent available to Business Associate, all information required
to permit Covered Entity to comply with the requirements of 45 C.F.R. Part 164
Subpart D.
(f) Covered Entity agrees and understands that the Covered Entity is
independently responsible for the security of all PHI in its possession (electronic or
otherwise), including all PHI that it receives from outside sources including the
Business Associate.
6. Term and Termination.
(a) Term. This Agreement shall be effective as of the Effective Date and
shall remain in effect until the Business Associate relationship with the Covered Entity
is terminated and all PHI is returned, destroyed or is otherwise protected as set forth in
Section 6(d).
(b) Termination for Cause by Covered Entity. Upon Covered Entity's
knowledge of a material breach by Business Associate, Covered Entity shall provide
an opportunity for Business Associate to cure the breach. If Business Associate does
not cure the breach within 30 days from the date that Covered Entity provides notice
of such breach to Business Associate, Covered Entity shall have the right to
immediately terminate this Agreement and the underlying services agreement between
Covered Entity and Business Associate.
(c) Termination by Business Associate. This Agreement may be
terminated by Business Associate upon 30 days prior written notice to Covered Entity
in the event that Business Associate, acting in good faith, believes that the
requirements of any law, legislation, consent decree, judicial action, governmental
regulation or agency opinion, enacted, issued, or otherwise effective after the date of
this Agreement and applicable to PHI or to this Agreement, cannot be met by Business
Associate in a commercially reasonable manner and without significant additional
expense.
(d) Effect of Termination. Upon termination of this Agreement for any
reason, at the request of Covered Entity, Business Associate shall return or destroy all
BOSS>Mandatory Standards>Documents>Business Associate Agreement including Security 03-2013
Page 5 of 9
PHI received from Covered Entity, or created or received by Business Associate on
behalf of Covered Entity. Business Associate shall not retain any copies of the PHI
unless necessary for proper document retention/archival purposes only or if such PHI
is stored as a result of backup email systems that store emails for emergency backup
purposes. If the return or destruction of PHI is infeasible, Business Associate shall
extend the protections of this Agreement to such PHI and limit further uses and
disclosures of such PHI to those purposes that make the return or destruction
infeasible, for so long as Business Associate maintains such PHI.
7. Amendment.
The parties may agree to amend this Agreement from time to time in any other respect
that they deem appropriate. This Agreement shall not be amended except by written
instrument executed by the parties.
8. Indemnification.
Business Associate shall indemnify and hold harmless Covered Entity from and
against any and all costs, expenses, claims, demands, causes of action, damages, attorneys'
fees and judgments that arise out of or that may be imposed upon, incurred by, or brought
against Covered Entity to the extent directly resulting from a breach of this Agreement or any
violation of the Privacy Rule or other applicable HIPAA regulations by Business Associate.
The indemnification obligations provided for in this Section will commence on the effective
date of this Agreement and will survive its termination.
To the extent allowed by Section 768.28, Florida Statutes, Covered Entity shall
indemnify and hold harmless Business Associate from and against any and all costs, expenses,
claims, demands, causes of action, damages, attorneys' fees and judgments that arise out of or
are imposed upon, incurred by, or brought against Business Associate to the extent directly
resulting from a breach of this Agreement or any violation of the Privacy Rule or other
applicable HIPAA regulations by Covered Entity. The indemnification obligations provided
for in this Section will commence on the effective date of this Agreement and will survive its
termination.
9. Severability.
The parties intend this Agreement to be enforced as written. However, (i) if any
portion or provision of this Agreement is to any extent declared illegal or unenforceable by a
duly authorized court having jurisdiction, then the remainder of this Agreement, or the
application of such portion or provision in circumstances other than those as to which it is so
declared illegal or unenforceable, will not be affected thereby, and each portion and provision
of this Agreement will be valid and enforceable to the fullest extent permitted by law; and (ii)
if any provision, or part thereof, is held to be unenforceable because of the duration of such
provision, the Covered Entity and the Business Associate agree that the court making such
determination will have the power to modify such provision, and such modified provision will
then be enforceable to the fullest extent permitted by law.
BOSS>Mandatory Standards>Documents>Business Associate Agreement including Security 03-2013
Page 6 of 9
10. Notices.
All notices, requests, consents and other communications hereunder will be in writing,
will be addressed to the receiving party's address set forth below or to such other address as a
party may designate by notice hereunder, and will be either (i) delivered by hand, (ii) made
facsimile transmission, (iii) sent by overnight courier, or (iv) sent by registered mail or
certified mail, return receipt requested, postage prepaid.
If to the Covered Entity:
If to the Business Associate:
Monroe County Board of County Commissioners
Attn: Director, Employee Services Division
1100 Simonton St.
Key West, FL 33040
(305) 295-4458
Gallagher Benefit Services, Inc.
2255 Glades Road
Boca Raton, FL 33431
561-995-6706
11. Regulatory References.
A reference in this Agreement to a section in the Privacy Rule means the referenced
section or its successor, and for which compliance is required.
12. Headings and Captions.
The headings and captions of the various subdivisions of the Agreement are for
convenience of reference only and will in no way modify or affect the meaning or
construction of any of the terms or provisions hereof.
13. Entire Agreement.
This Agreement sets forth the entire understanding of the parties with respect to the
subject matter set forth herein and supersedes all prior agreements, arrangements and
communications, whether oral or written, pertaining to the subject matter hereof.
14. Binding Effect.
The provisions of this Agreement shall be binding upon and shall inure to the benefit
of both Parties and their respective successors and assigns.
BOSS>Mandatory Standards>Documents>Business Associate Agreement including Security 03-2013
Page 7 of 9
15. No Waiver of Rights, Powers and Remedies.
No failure or delay by a party hereto in exercising any right, power or remedy under
this Agreement, and no course of dealing between the parties hereto, will operate as a waiver
of any such right, power or remedy of the party. No single or partial exercise of any right,
power or remedy under this Agreement by a party hereto, nor any abandonment or
discontinuance of steps to enforce any such right, power or remedy, will preclude such party
from any other or further exercise thereof or the exercise of any other right, power or remedy
hereunder. The election of any remedy by a party hereto will not constitute a waiver of the
right of such party to pursue other available remedies. No notice to or demand on a party not
expressly required under this Agreement will entitle the party receiving such notice or
demand to any other or further notice or demand in similar or other circumstances or
constitute a waiver of the right of the party giving such notice or demand to any other or
further action in any circumstances without such notice or demand. The terms and provisions
of this Agreement may be waived, or consent for the departure therefrom granted, only by
written document executed by the party entitled to the benefits of such terms or provisions.
No such waiver or consent will be deemed to be or will constitute a waiver or consent with
respect to any other terms or provisions of this Agreement, whether or not similar. Each such
waiver or consent will be effective only in the specific instance and for the purpose for which
it was given, and will not constitute a continuing waiver or consent.
16. Governing Law.
This Agreement will be governed by and construed in accordance with HIPAA, and
the laws of the State of Florida to the extent they are not preempted by HIPAA or other
federal law.
17. Interpretation.
It is the Parties' intent to comply strictly with all applicable laws, including without
limitation, HIPAA, state statutes, or regulations (collectively, the "Regulatory Laws"), in
connection with this Agreement. In the event there shall be a change in the Regulatory Laws,
or in the reasoned interpretation of any of the Regulatory Laws or the adoption of new federal
or state legislation, any of which are reasonably likely to materially and adversely affect the
manner in which either Party may perform or be compensated under this Agreement or which
shall make this Agreement unlawful, the Parties shall immediately enter into good faith
negotiations regarding a new arrangement or basis for compensation pursuant to this
Agreement that complies with the law, regulation or policy and that approximates as closely
as possible the economic position of the Parties prior to the change. In addition, the Parties
hereto have negotiated and prepared the terms of this Agreement in good faith with the intent
that each and every one of the terms, covenants and conditions herein be binding upon and
inure to the benefit of the respective Parties. To the extent this Agreement is in violation of
applicable law, then the Parties agree to negotiate in good faith to amend this Agreement, to
the extent possible consistent with its purposes, to conform to law.
BOSS>Mandatory Standards>Documents>Business Associate Agreement including Security 03-2013
Page 8 of 9
18. Successors and Assigns. This Agreement will inure to the benefit of and be
binding on the successors and assign of Covered Entity and Business Associate. However,
the Agreement is not assignable by either party except with the express written consent of the
other, which consent shall not be unreasonably withheld.
IN WITNESS WHEREOF, the parties have executed this Business Associate
Agreement as of the Effective Date.
BUSINESS ASSOCIATE:
G)
By
Na
Tit
COVERED ENTITY:
INC.
MONROE COUNTY BOARD OF COUNTY
COMMISSIONERS
By: _
Name:
Title:
MONRUt i UHNEY
AP OV D AS TO FORM:
C NTHIA L. HAL
ASSISTANT C" JN: -ORNEY
Date.. - 51,�„� wl?
BOSS>Mandatory Standards>Documents>Business Associate Agreement including Security 03-2013
Page 9 of 9