Item C03BOARD OF COUNTY COMMISSIONERS
AGENDA ITEM SUMMARY
Meeting Date: March 19, 2008 Division: Employee Services
Bulk Item: Yes X No Department: Employee Benefits
Staff Contact Person/Phone #: Maria Z. Fernandez -Gonzalez — 292-4448
AGENDA ITEM WORDING: Approval of Business Associate Addendum: Group Health Plan
with Delta Dental Insurance Company, administrator of group dental program for Monroe
County. Addendum covers security of Protected Health Information (PHI) as required by the
Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule effective
April 13, 2006.
ITEM BACKGROUND: The Health Insurance Portability and Accountability Act of 1996
(HIPAA) Privacy Rule effective April 13, 2003 requires the entering of Business Associates
Agreements with providers of health care services to regulate the use and disclosure of Protected
Health Information (PHI).
PREVIOUS RELEVANT BOCC ACTION: N/A
CONTRACT/AGREEMENT CHANGES: New provisions covered under the Health Insurance
Portability and Accountability Act of 1996 (HIPAA).
STAFF RECOMMENDATIONS: Approval.
TOTAL COST: N/A BUDGETED: Yes No
COST TO COUNTY: N/A SOURCE OF FUNDS:
REVENUE PRODUCING: Yes _ No _ AMOUNT PER MONTH Year _
APPROVED BY: County Atty��' OMB/Purchas' Risk Management
DOCUMENTATION: Included X Not Required
DISPOSITION: AGENDA ITEM #
Revised I1/06
ECENED
FEB 2 7 2008
"E-r
C
UNTY So�MONROE
KEY WESTEc7RIDA 33040
(305)294-4641 �
Office of the Employee Services Division Director W�17jjmr
The Historic Gato Cigar Factory
1100 Simonton Street, Suite 268
Key West, FL 33040
(305) 2924458 — Phone ''4#
(305) 292-4564 - Fax
TO: Board of County Commissioners
FROM: Teresa E. Aguiar,
Employee Services Dir r
^� BOARD OF COUNTY COMMISSIONERS
Mayor Charles "Sonny" McCoy, District 3
Mayor Pro Tern Mario Di Gennaro, District 4
Dixie M. Spehar, District 1
George Neugent, District 2
Sylvia I Murphy, District S
DATE: February 27, 2008
SUBJ: Approval of Addendum to Contract - HIPAA
This item requests approval of an amendment to the existing contract between the County and Delta Dental
Insurance Company. The Business Associate Addendum covers the period of January 31, 2008 and shall
continue until the Contract is terminated. The addendum outlines the company's privacy practices and
provisions adhered to as they pertain to the covered individual's protected health information as required by
the Health Insurance Portability and Accountability Act (HIPAA).
It is recommended that the BOCC approve the addition of the amendment to the current contract. If you have
any questions on this item, please do not hesitate to contact me at X4458.
HIPAA BUSINESS ASSOCIATE ADDENDUM:
GROUP HEALTH PLAN
This HIPAA Business Associate Addendum ("Business Associate Addendum") supplements
and is/will be made a part of the group dental contract ("Contract") by and between Monroe
County Board of County Commissioners ("Sponsor/Contractholder") on behalf of the group
health plan and Delta Dental Insurance Company ("Delta Dental"). This Business Associate
Addendum is effective on the later of April 14, 2003 or the effective date of the Contract.
RECITALS
Whereas, the administrative simplification provisions of the Health Insurance Portability and
Accountability Act of 1996 and related regulations require that contracts between covered
entities and entities known as business associates comply with enumerated standards and
requirements;
Whereas, the Sponsor/Contractholder executes this Business Associate Addendum on behalf of
the Group Health Plan;
Whereas, Delta Dental's administration of the group dental program for the
Sponsor/Contractholder makes Delta Dental a business associate of the Group Health Plan as
described or defined under HIPAA;
Whereas, the purpose of this Business Associate Addendum is to satisfy the HIPAA standards
and requirements;
Now therefore, in consideration of the mutual promises below, the Sponsor/Contractholder, the
Group Health Plan and Delta Dental agree as follows:
SECTION 1 - DEFINITIONS
1.1 "HIPAA" shall mean the administrative simplification provisions of the Health Insurance
Portability and Accountability Act of 1996 and related regulations, Title 45 Parts 160 and 164 of
the Code of Federal Regulations, as amended from time to time.
1.2 "Protected Health Information" (PHI) shall have the same meaning as defined in HIPAA
and shall apply to those individuals who are eligible and/or enrolled in the Group Health Plan's
dental benefit program administered by Delta Dental.
1.3 Terms used, but not otherwise defined, in this Business Associate Addendum shall have
the same meaning as those terms have in HIPAA.
SECTION 2 - BUSINESS ASSOCIATE AGREEMENT
2.1 The provisions of this Section 2 control over any provision in the Contract that conflicts
with this Section 2.
2.2 Permitted Uses and Disclosures.
a. Delta Dental shall use and/or disclose PHI received, created or maintained by
Delta Dental in accordance with the uses and disclosures described in Exhibit A.
b. Delta Dental shall not use or further disclose PHI other than as permitted or
required by this Business Associate Addendum, any law or regulation.
DDIC HIPAA BAA (Insured-12/06)
C. Except as otherwise limited in this Business Associate Addendum, Delta Dental
may use PHI for Delta Dental's proper management and administration or to carry out Delta
Dental's legal responsibilities.
d. Except as otherwise limited in this Business Associate Addendum, Delta Dental
may disclose PHI for Delta Dental's proper management and administration, provided that
disclosures are Required By Law, or Delta Dental obtains reasonable assurances from the
person to whom the PHI is disclosed that it will remain confidential and used or further disclosed
only as Required By Law or for the purpose for which it was disclosed to the person, and the
person notifies Delta Dental of any instances of which it is aware in which the confidentiality of
the PHI has been breached.
2.3 Appropriate Safeguards. Delta Dental agrees to use appropriate safeguards to prevent
its use or disclosure of PHI other than as provided for by this Business Associate Addendum.
2.4 Mitigation. Delta Dental agrees to mitigate, to the extent practicable, any harmful effect
that is known to Delta Dental of a use or disclosure of PHI by Delta Dental in violation of the
requirements of this Business Associate Addendum.
2.5 Reportinq of Disclosures of PHI. As soon as practical after discovery, Delta Dental shall
report to the Group Health Plan, or its designate, any use or disclosure of PHI by Delta Dental
not provided for in this Business Associate Addendum of which Delta Dental becomes aware.
2.6 Agents and Contractors. Delta Dental shall ensure that any Delta Dental agent or
subcontractor to whom Delta Dental discloses PHI agrees, in writing, to be bound by the same
restrictions and conditions that apply to Delta Dental through this Business Associate
Addendum.
2.7 Access to and Availability of PHI. Delta Dental shall, in accordance with HIPAA and as
appropriate:
a. Provide access to the requested PHI within Delta Dental's or its agent's or
subcontractor's possession. The Group Health Plan shall as soon as practicable forward to
Delta Dental any requests the Group Health Plan receives from the individual. Delta Dental
shall be responsible for responding to the Group Health Plan or individual who sent the request
to Delta Dental. If the response is to be sent to the Group Health Plan, Delta Dental shall send
the PHI to the Group Health Plan within fifteen (15) days of Delta Dental's receipt of the request.
b. Amend, notify appropriate recipients of any amendment, and incorporate any
amendment to the requested PHI within Delta Dental's possession or its agent's or
subcontractor's. The Group Health Plan shall as soon as practicable forward to Delta Dental
any requests the Group Health Plan receives from the individual. Delta Dental shall be
responsible for responding to the Group Health Plan or individual who sent the request to Delta
Dental. If the response is to be sent to the Group Health Plan, Delta Dental shall send the
response to the Group Health Plan within thirty (30) days of Delta Dental's receipt of the
request.
C. Provide an accounting of disclosures of PHI as required by HIPAA. The Group
Health Plan shall as soon as practicable forward to Delta Dental any requests the Group Health
Plan receives from the individual. Delta Dental shall be responsible for responding to the Group
Health Plan or individual who sent the request to Delta Dental. Delta Dental agrees to track,
and request that its agents or subcontractors track, all such disclosures of PHI that would be
required to respond to a request for accounting of disclosures of PHI as required by HIPAA. If
the response is to be sent to the Group Health Plan, Delta Dental shall send the accounting to
the Group Health Plan within thirty (30) days of Delta Dental's receipt of the request.
DDIC HIPAA BAA (Insured-12/06) 2
2.8 Availability of Delta Dental's Internal Practices Books and Records. Delta Dental agrees
to make its internal practices, books and records, including policies and procedures and PHI,
relating to its use and disclosure of PHI available to the Group Health Plan, upon reasonable
notice from the Group Health Plan, and the Secretary of Health and Human Services for
purposes of determining Group Health Plan's and Delta Dental's compliance with this Business
Associate Addendum and the HIPAA privacy standards.
2.9 Sponsor/Contractholder Compliance. If the Sponsor/Contractholder and/or Group
Health Plan receives non -enrollment PHI from Delta Dental, then the Sponsor/Contractholder
and/or Group Health Plan, as appropriate, shall be responsible for their compliance with
HIPAA's administrative requirements resulting from the Sponsor/Contractholder's and/or Group
Health Plan's activities including but not limited to, privacy officer designation, training, etc.
2.10 Sponsor/Contractholder Responsibilities. Sponsor/Contractholder and/or Group Health
Plan agree to timely:
a. Forward any request it receives to the appropriate party as set forth in section 2.7
above,
b. Notify Delta Dental of any restriction, or any change thereto, to the use or
disclosure of PHI that the Group Health Plan has agreed to in accordance with 45 CFR 164.522,
to the extent that such restriction(s) and/or change(s) may affect Delta Dental's use or
disclosure of PHI; and
C. Notify Delta Dental of any changes in, or withdrawal of, any authorizations
provided to the Group Health Plan by the individual and forwarded by the Group Health Plan to
Delta Dental.
Unless otherwise specifically provided in this Business Associate Addendum, Delta
Dental shall only be responsible to comply with the authorizations, restrictions or limitations
conveyed by the Sponsor/Contractholder in accordance with this Section 2.10.
2.11 Term and Termination of the Contract and this Business Associate Addendum.
a. Term. The term of this Business Associate Addendum shall be effective on the
effective date of the Contract and shall continue until the Contract is terminated.
b. Termination for Cause. The Sponsor/Contractholder may terminate this
Business Associate Addendum and the Contract upon the Sponsor/Contractholder's knowledge
that Delta Dental has materially breached this Business Associate Addendum if, within thirty
(30) days after receipt of written notice of such material breach, Delta Dental fails to take action
to cure the breach or end the violation. Sponsor/Contractholder may immediately terminate this
Business Associate Addendum and the Contract if Delta Dental has breached a material term of
this Business Associate Addendum and cure is not possible. If neither termination nor cure is
feasible, Sponsor/Contractholder may report the violation to the Secretary of Health and Human
Services.
C. In the event of any termination of this Business Associate Addendum, Delta
Dental shall return or destroy all PHI that Delta Dental still maintains in any form and shall retain
no copies. If return or destruction is not feasible because such PHI is necessary to fulfill Delta
Dental's legal responsibilities or other management and administrative purposes, Delta Dental
shall retain the PHI and shall continue to protect the confidentiality of PHI as required by this
Business Associate Addendum. Delta Dental shall limit any use or disclosure of PHI to those
purposes that make the return or destruction of PHI infeasible. Delta Dental agrees to require
that any PHI in the possession of its agents or subcontractors be retained, returned or
destroyed, as applicable.
DDIC HIPAA 6AA (Insured-12/06)
d. The following sections shall survive termination of this Addendum: 2.7, 2.8, 2.11,
5.2, and 5.3.
2.12 Notice of Privacy Practices. Delta Dental's notice of privacy practices will be provided
to the primary enrollees covered under the group dental plan administered by Delta Dental.
However, Delta Dental and the Sponsor/Contractholder agree that Delta Dental will delegate the
distribution of Delta Dental's notice to the Sponsor/Contractholder, and the
Sponsor/Contractholder agrees to distribute, at no cost to Delta Dental, that privacy notice to the
primary enrollees within the time frames required by HIPAA.
2.13 Security Rule Provisions. Delta Dental will comply with the following provisions by April
21, 2005, or such other applicable compliance date. For purposes of this section, "electronic
protected health information" (ePHI) shall have the same meaning as defined in HIPAA and
shall apply to those individuals who are eligible and/or enrolled in the Group Health Plan's
dental benefit program administered by Delta Dental.
a. ' Delta Dental shall implement administrative, physical, and technical safeguards
that reasonably and appropriately protect the confidentiality, integrity, and availability of the
ePHI that it creates, receives, maintains, or transmits on behalf of the Group Health Plan.
b. Delta Dental shall ensure that any agent, including a subcontractor, to whom
Delta Dental provides ePHI agrees to implement reasonable and appropriate safeguards to
protect ePHI.
C. ° As soon as practical after discovery, Delta Dental shall report to the Group
Health Plan any Security Incident of which Delta Dental becomes aware.
d. Delta Dental agrees to authorize termination of this Business Associate
Addendum and the Contract as described in Section 2.11, above, by the
Sponsor/Contractholder if the Sponsor/Contractholder has knowledge that Delta Dental has
violated a material term of this Business Associate Addendum.
SECTION 3 — DISCLOSURE TO PLAN SPONSOR/CONTRACTHOLDER
3.1 Amendment of the Contract. Delta Dental and Sponsor/Contractholder agree to amend
the Contract as set forth in this section to allow the Group Health Plan and/or Delta Dental to
disclose non -enrollment PHI to the Sponsor/Contractholder.
3.2 Notice of Privacy Practices. Delta Dental's notice of privacy practices will advise that
Delta Dental may disclose non -enrollment PHI to the Sponsor/Contractholder.
3.3 Disclosure of PHI to Plan Sponsor/Contractholder. The Sponsor/Contractholder
represents and warrants that if the prior conditions in Sections 3.1 and 3.2 have been met, Delta
Dental may disclose non -enrollment PHI to the classes of employees and other persons
identified by Sponsor/Contractholder to carry out the plan administration functions. Delta Dental
shall not disclose PHI to such persons for the purpose of employment -related actions or
decisions or in connection with any other benefit plan of the Sponsor/Contractholder.
3.4 Identification of Employees and Other Persons. The Sponsor/Contractholder agrees
that Delta Dental may rely upon the most recent list of classes of employees (or update thereof)
provided by the Sponsor/Contractholder.
3.5 Disclosure of Enrollment and Summary Health Information. Sections 3.1 and 3.2 do not
apply to disclosures of enrollment information and summary information as defined in HIPAA.
Delta Dental may disclose to the Sponsor/Contractholder summary health information:
a. To obtain premium bids for providing dental benefits coverage under the Group
Health Plan;
DDIC HIPAA BAA (Insured-12/06) 4
b. To modify, amend or terminate the Group Health Plan; or
As otherwise permitted by HIPAA.
3.6 Amendment of this Addendum as Group Health Plan Document.
Sponsor/Contractholder and Delta Dental acknowledge that the Contract constitutes the group
health plan document for the dental program administered by Delta Dental. This section 3.6
shall serve as the amendment to the group health plan document as required by HIPAA to
permit Delta Dental to disclose non -enrollment PHI to the Sponsor/Contractholder. The
provisions of this Section 3.6 control over any provision in the Contract that conflicts with this
section.
a. Sponsor/Contractholder Certification. The following terms of this section
incorporate the requirements of HIPAA to permit the Group Health Plan or Delta Dental to
lawfully disclose non -enrollment PHI to the Sponsor/Contractholder or its agents. This section
shall serve as the Sponsor/Contractholder's certification as required by HIPAA.
b. Permitted Uses and Disclosures.
i. Sponsor/Contractholder, its directors, officers, employees, contractors
and agents shall use and/or disclose PHI received by Sponsor/Contractholder solely in
accordance with the uses and disclosures described in Exhibit B which is attached to and made
a part of this Business Associate Addendum.
ii. Sponsor/Contractholder shall not, and shall ensure that its directors,
officers, employees contractors and agents do not, use or further disclose PHI in any manner
except as permitted or required by this Business Associate Addendum or as required by law or
regulation.
C. Agents and Subcontractors. Sponsor/Contractholder shall ensure that any agent
or subcontractor that will have access to PHI from Sponsor/Contractholder agrees to be bound
by the same restrictions, terms and conditions that apply to Sponsor/Contractholder pursuant to
this Business Associate Addendum.
d. Employment -Related Actions and Decisions. The Sponsor/Contractholder shall
not use or disclose PHI for employment -related actions or decisions or in connection with any
other benefit plan of the Sponsor/Contractholder.
e. Reporting of Disclosures of PHI. Sponsor/Contractholder shall, as soon as
possible after becoming aware of an actual or suspected disclosure of PHI in violation of this
Business Associate Addendum by Sponsor/Contractholder, its officers, directors, employees,
subcontractors or agents or by a third party to which Sponsor/Contractholder disclosed PHI
pursuant to this Business Associate Addendum, report any such disclosure to the Group Health
Plan.
f. Access to and Availability of PHI. Sponsor/Contractholder shall timely and in
compliance with HIPAA requirements:
i. Make available to the Group Health Plan or Delta Dental, as appropriate,
the requested PHI to respond to an individual's request for access to PHI.
ii. Provide to the Group Health Plan or Delta Dental, as appropriate, the
requested PHI to respond to a request for amendment and shall incorporate any amendment
received from the Group Health Plan or Delta Dental.
iii. Make available to the Group Health Plan or Delta Dental, as appropriate,
the requested PHI to respond to an individual's request for an accounting of disclosures of PHI.
DDIC HIPAA BAA (Insured-12/06) 5
The Sponsor/Contractholder agrees to track all disclosures of PHI that would be required to
respond to a request for accounting of disclosures of PHI as required by HIPAA.
g. Availability of Sponsor's/Contractholder's Internal Practices. Books and Records.
Sponsor/Contractholder agrees to make its internal practices, books and records relating to the
use and disclosure of PHI received from the Group Health Plan or Delta Dental available to the
Secretary of Health and Human Services for purposes of determining the Group Health Plan's
and Sponsor/Contractholder's compliance with the HIPAA privacy standards.
h. Return or Destruction of PHI. Sponsor/Contractholder shall return or destroy all
PHI received from the Group Health Plan or its agent that the Sponsor/Contractholder maintains
in any form and shall retain no copies when such PHI is no longer needed for the purpose for
which the disclosure was made. If return or destruction is not feasible, Sponsor/Contractholder
shall continue to protect the confidentiality of PHI as required by this Business Associate
Addendum and limit any use or disclosure of PHI to those purposes that make the return or
destruction of PHI infeasible.
i. Adequate Separation. Sponsor/Contractholder shall ensure adequate separation
as required by HIPAA by doing the following:
i. Sponsor/Contractholder shall identify the Sponsor/Contractholder's
classes of employees or other persons to whom the Group Health Plan, its agent, or Delta
Dental shall disclose PHI.
ii. Sponsor/Contractholder shall restrict access to PHI and use of PHI by
such employees or other persons to the plan administration functions that
Sponsor/Contractholder performs for the Group Health Plan.
iii. Sponsor/Contractholder shall implement an effective mechanism for
resolving any issues of noncompliance by such employees or other persons, and such
mechanism shall be consistent with the terms of this Business Associate Addendum.
j. Security Rule Provisions. Sponsor/Contractholder will comply with the following
provisions by April 21, 2005, or such other applicable compliance date. For purposes of this
section, "electronic protected health information" (ePHI) shall have the same meaning as
defined in HIPAA and shall apply to those individuals who are eligible and/or enrolled in the
Group Health Plan's dental benefit program administered by Delta Dental.
i. Sponsor/Contractholder shall implement administrative, physical, and
technical safeguards that reasonably and appropriately protect the confidentiality, integrity, and
availability of the ePHI that it creates, receives, maintains, or transmits on behalf of the Group
Health Plan.
ii. Sponsor/Contractholder shall ensure that any agent, including a
subcontractor, to whom the Sponsor/Contractholder provides ePHI agrees to implement
reasonable and appropriate safeguards to protect ePHI.
iii. As soon as practical after discovery, Sponsor/Contractholder shall report
to the Group Health Plan any Security Incident of which Sponsor/Contractholder becomes
aware.
iv. Sponsor/Contractholder shall ensure adequate separation as required by
HIPAA by complying with Section 3.6 (i) above for the ePHI created and received by the
Sponsor/Contractholder.
DDIC HIPAA BAA (Insured-12/06) 6
SECTION 4 - DISCLOSURE TO BUSINESS ASSOCIATE
4.1 The Sponsor/Contractholder represents and warrants that prior to requesting Delta
Dental to disclose PHI to the Group Health Plan's business associate(s), including but not
limited to, a broker, consultant, TPA or auditor, the Group Health Plan, or the
Sponsor/Contractholder on the Group Health Plan's behalf, shall have entered into a business
associate contract or have other satisfactory arrangement with such business associate(s) that
complies with the requirements of HIPAA. Sponsor/Contractholder and/or the Group Health
Plan agree to provide Delta Dental with documentation relating to the business associate's
permission to receive PHI from Delta Dental.
4.2 Disclosure to a business associate pursuant to this Section 4 shall not include a
disclosure to the Sponsor/Contractholder nor to its identified employees.
SECTION 5 - GENERAL
5.1 Amendment to Business Associate Addendum. Sponsor/Contractholder and Delta
Dental agree to amend this Business Associate Addendum as necessary to comply with federal
or state laws or regulations relating to the administrative simplification provisions of HIPAA.
5.2 Indemnification by Delta Dental. Delta Dental agrees to indemnify, defend and hold
harmless the Group Health Plan, or the Sponsor/Contractholder on the Group Health Plan's
behalf, and their employees, directors, officers, subcontractors, agents or other members of its
workforce, each of the foregoing hereinafter referred to as "Indemnified Party," against all actual
and direct losses suffered by the Indemnified Party and all liability to third parties arising from or
in connection with Delta Dental's breach of sections 2 or 3 of this Business Associate
Addendum. Accordingly, on demand, Delta Dental shall reimburse any Indemnified Party for
any and all actual and direct losses, liabilities, fines, penalties, costs or expenses (including
reasonable attorneys' fees) which may for any reason be imposed upon any Indemnified Party
by reason of any suit, claim, action, proceeding or demand by any third party which results from
Delta Dental's breach hereunder. Delta Dental's obligation to indemnify any Indemnified Party
shall survive the expiration or termination of this Business Associate Addendum for any reason.
5.3 Indemnification by Group Health Plan or Sponsor/Contractholder. The Group Health
Plan, or the Sponsor/Contractholder on the Group Health Plan's behalf, agrees to indemnify,
defend and hold harmless Delta Dental and its employees, directors, officers, subcontractors,
agents or other members of its workforce, each of the foregoing hereinafter referred to as
"Indemnified Party," against all actual and direct losses suffered by the Indemnified Party and all
liability to third parties arising from or in connection with the Group Health Plan's or
Sponsor/Contractholder's breach of Sections 2, 3 or 4 of this Business Associate Addendum.
Accordingly, on demand, the Group Health Plan or Sponsor/Contractholder shall reimburse any
Indemnified Party for any and all actual and direct losses, liabilities, fines, penalties, costs or
expenses (including reasonable attorneys' fees) which may for any reason be imposed upon
any Indemnified Party by reason of any suit, claim, action, proceeding or demand by any third
party which results from the Group Health Plan's or Sponsor/Contractholder's breach
hereunder. The obligation to indemnify any Indemnified Party shall survive the expiration or
termination of this Business Associate Addendum for any reason.
5.4 Interpretation. This Business Associate Addendum shall be interpreted to allow the
parties to comply with HIPAA, provided, however, that nothing herein shall be construed to grant
rights beyond those provided under HIPAA or applicable law.
5.5 No Third Party Beneficiary. Nothing express or implied in this Business Associate
Addendum is intended to confer, nor shall anything in this Business Associate Addendum
confer, upon any person other than the parties to this Business Associate Addendum and their
respective successors and assigns, any rights, remedies, obligations or liabilities whatsoever.
DDIC HIPAA BAA (Insured-12/06)
IN WITNESS WHEREOF, Sponsor/Contractholder and Delta Dental have duly executed this
Business Associate Addendum as of the date listed below.
Sponsor/Contractholder represents and warrants that it is signing this Addendum in its capacity
as the sponsor of the Group Health Plan and not in a capacity of a business associate to the
Group Health Plan.
Sponsor/Contractholder: MONROE COUNTY BOARD OF COUNTY COMMISSIONERS
Group Contract Number: 10-9595
Signature: _
Print Name:
Print Title:
Date:
Delta Dental Insurance Company
Signature:
Print Name: Debbie Shealy
Print Title: Vice President, Marketing Administration
Date: December 26, 2007
JONROE COUNTY ATTORNE'`,'
AP ROVED AS TO OR
`��
YNTHIA L. HALL
ASSISTANT COUNTY ATTORNEY
Z --0
DDIC HIPAA BAA (Insured-12/06) 8
EXHIBIT A TO HIPAA BUSINESS ASSOCIATE ADDENDUM:
GROUP HEALTH PLAN
Delta Dental's Permitted Uses and Disclosures:
Except as otherwise limited in this Business Associate Addendum, Delta Dental shall use and
disclose PHI:
A. To perform the functions, activities, or services for, or on behalf of, the Group Health
Plan as specified in the Contract, provided that such use or disclosure would not violate HIPAA
if done by the Group Health Plan.
B. For the Group Health Plan's treatment, payment and health care operations as defined
and permitted under HIPAA with respect to Delta Dental's administration of the dental benefits
program for the Group Health Plan as described in the Contract.
C. For Delta Dental's treatment, payment and health care operations as defined and
permitted under HIPAA with respect to Delta Dental's administration of the dental benefits
program for the Group Health Plan as described in the Contract.
D. To Delta Dental's agents or subcontractors as necessary for Delta Dental to perform the
services described in the Contract.
E. To the Group Health Plan's or Sponsor/Contractholder's business associate, agent or
subcontractor as requested by the Sponsor/Contractholder.
F. To provide Data Aggregation services to the Group Health Plan if mutually agreed upon
between Group Health Plan and Delta Dental.
G. To provide to or obtain de -identification services for the Group Health Plan if mutually
agreed upon between Group Health Plan and Delta Dental.
H. As otherwise required or permitted by HIPAA or federal or state law.
I. To report violations of law to appropriate federal or state authorities, consistent with 45
CFR §164.502 0) (1).
J. As otherwise requested by the Sponsor/Contractholder or the Group Health Plan that is
not in violation of HIPAA.
DDIC HIPAA BAA (Insured-12/06) 9
EXHIBIT B TO HIPAA BUSINESS ASSOCIATE ADDENDUM:
GROUP HEALTH PLAN
Sponsor/C ontracthol der's Uses and Disclosures
Sponsor/Contractholder shall use and disclose PHI only in compliance with HIPAA and for the
purpose of providing plan administration functions to the Group Health Plan. Plan
administrative functions are defined as administration functions performed by the plan sponsor
of a group health plan on behalf of the group health plan and excludes functions performed by
the plan sponsor in connection with any other benefit or benefit plan of the plan sponsor.
DDIC HIPAA BAA (Insured-12/06) 10
Notice of Privacy Practices.
Confidentiality of your health care information
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED
AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE
REVIEW IT CAREFULLY.
This notice is required by law to tell you how Delta Dental Insurance Company and its affiliates
("Delta Dental") protect the confidentiality of your health care information in our possession.
Protected Health Information (PHI) is defined as any individually identifiable information
regarding a patient's health care history; mental or physical condition; or treatment. Some
examples of PHI include your name, address, telephone and/or fax number, electronic mail
address, social security number or other identification number, date of birth, date of
treatment, treatment records, x-rays, enrollment and claims records. Delta Dental receives,
uses and discloses your PHI to administer your benefit plan or as permitted or required by law.
Any other disclosure of your PHI without your authorization is prohibited.
We must follow the privacy practices that are described in this notice, but also comply with
any stricter requirements under federal or state law that may apply to our administration of
your benefits. However, we may change this notice and make the new notice effective for all
of your PHI that we maintain. If we make any substantive changes to our privacy practices,
we will promptly change this notice and redistribute to you within 60 days of the change to our
practices. You may also request a copy of this notice anytime by contacting the address or
phone number at the end of this notice. You should receive a copy of this notice at the time of
enrollment in a Delta Dental program, and we will notify you of how you can receive a copy of
this notice at least once every three years.
Permitted Uses and Disclosures of Your PHI
We are permitted to use or disclose your PHI without your prior authorization for the following
purposes. These permitted uses and/or disclosures include disclosures to you, uses and/or
disclosures for purposes of health care treatment, payment of claims, billing of premiums, and
other health care operations. If your benefit plan is sponsored by your employer or another
party, we may provide PHI to your employer or that sponsor for purposes of administering
your benefits. We may disclose PHI to third parties that perform services for Delta Dental in
the administration of your benefits. These parties are required by law to sign a contract
agreeing to protect the confidentiality of your PHI. Your PHI may be disclosed to an affiliate
that performs services for Delta Dental in the administration of your benefits. These affiliates
have implemented privacy policies and procedures and comply with applicable federal and
state law.
We are also permitted to use and/or disclose your PHI to comply with a valid authorization, to
notify or assist in notifying a family member, another person, or a personal representative of
your condition, to assist in disaster relief efforts, and to report victims of abuse, neglect, or
domestic violence. Other permitted uses and/or disclosures are for purposes of health
oversight by government agencies, judicial, administrative, or other law enforcement
purposes, information about decedents to coroners, medical examiners and funeral directors,
for research purposes, for organ donation purposes, to avert a serious threat to health or
safety, for specialized government functions such as military and veterans activities, for
workers compensation purposes, and for use in creating summary information that can no
longer be traced to you. Additionally, with certain restrictions, we are permitted to use and/or
disclose your PHI for underwriting. We are also permitted to incidentally use and/or disclose
your PHI during the course of a permitted use and/or disclosure, but we must attempt to keep
incidental uses and/or disclosures to a minimum. We use administrative, technical, and
physical safeguards to maintain the privacy of your PHI, and we must limit the use and/or
disclosure of your PHI to the minimum amount necessary to accomplish the purpose of the use
and/or disclosure.
Examples of Uses and Disclosures of Your PHI for Treatment, Payment
or Healthcare Operations
Such activities may include but are not limited to: processing your claims, collecting
enrollment information and premiums, reviewing the quality of health care you receive,
providing customer service, resolving your grievances, and sharing payment information with
other insurers. Additional examples include the following.
• Uses and/or disclosures of PHI in facilitating treatment.
For example, Delta Dental may use or disclose your PHI to determine eligibility for
services requested by your provider.
• Uses and/or disclosures of PHI for payment.
For example, Delta Dental may use and disclose your PHI to bill you or your plan
sponsor.
• Uses and/or disclosures of PHI for health care operations.
For example, Delta Dental may use and disclose your PHI to review the quality of care
provided by our network of providers.
Disclosures Without an Authorization
We are required to disclose your PHI to you or your authorized personal representative (with
certain exceptions), when required by the U. S. Secretary of Health and Human Services to
investigate or determine our compliance with law, and when otherwise required by law. Delta
Dental may disclose your PHI without your prior authorization in response to the following:
• Court order;
• Order of a board, commission, or administrative agency for purposes of adjudication
pursuant to its lawful authority;
• Subpoena in a civil action;
• Investigative subpoena of a government board, commission, or agency;
• Subpoena in an arbitration;
• Law enforcement search warrant; or
• Coroner's request during investigations
Disclosures Delta Dental Makes With Your Authorization
Delta Dental will not use or disclose your PHI without your prior authorization if the law
requires your authorization. You can later revoke that authorization in writing to stop any
future use and disclosure. The authorization will be obtained from you by Delta Dental or by a
person requesting your PHI from Delta Dental.
Your Rights Regarding PHI
You have the right to request an inspection of and obtain a copy of your PHI. You may
access your PHI by contacting the appropriate Delta Dental office. You must include (1) your
name, address, telephone number and identification number and (2) the PHI you are
requesting. Delta Dental may charge a reasonable fee for providing you copies of your PHI.
Delta Dental will only maintain that PHI that we obtain or utilize in providing your health care
benefits. Most PHI, such as treatment records or X-rays, is returned by Delta Dental to the
dentist after we have completed our review of that information. You may need to contact your
health care provider to obtain PHI that Delta Dental does not possess.
You may not inspect or copy PHI compiled in reasonable anticipation of, or use in, a civil,
criminal, or administrative action or proceeding, or PHI that is otherwise not subject to
disclosure under federal or state law. In some circumstances, you may have a right to have
this decision reviewed. Please contact the privacy office as noted below if you have questions
about access to your PHI.
You have the right to request a restriction of your PHI. You have the right to ask that
we limit how we use and disclose your PHI. We will consider your request but are not legally
required to accept it. If we accept your request, we will put any limits in writing and abide by
them except in emergency situations. You may not limit the uses and disclosures that we are
legally required or allowed to make.
You have the right to correct or update your PHI. This means that you may request an
amendment of PHI about you for as long as we maintain this information. In certain cases we
may deny your request for an amendment. If we deny your request for amendment, you have
the right to file a statement of disagreement with us and we may prepare a rebuttal to your
statement and will provide you with a copy of any such rebuttal. If your PHI was sent to us by
another, we may refer you to that person to amend your PHI. For example, we may refer you
to your dentist to amend your treatment chart or to your employer, if applicable, to amend
your enrollment information. Please contact the privacy office as noted below if you have
questions about amending your PHI.
You have the right to request or receive confidential communications from us by
alternative means or at a different address. We will agree to a reasonable request if you
tell us that disclosure of your PHI could endanger you. You may be required to provide us with
a statement of possible danger, a different address, another method of contact or information
as to how payment will be handled. Please make this request in writing to the privacy office as
noted below.
You have the right to receive an accounting of certain disclosures we have made, if
any, of your PHI. This right does not apply to disclosures for purposes of treatment,
payment, or health care operations or for information we disclosed after we received a valid
authorization from you. Additionally, we do not need to account for disclosures made to you,
to family members or friends involved in your care, or for notification purposes. We do not
need to account for disclosures made for national security reasons or certain law enforcement
purposes, disclosures made as part of a limited data set, incidental disclosures, or disclosures
made prior to April 14, 2003. Please contact the privacy office as noted below if you would like
to receive an accounting of disclosures or if you have questions about this right.
You have the right to get this notice by e-mail. You have the right to get a copy of this
notice by e -mail. Even if you have agreed to receive notice via a -mail, you also have the right
to request a paper copy of this notice.
Complaints
You may complain to us or to the U. S. Secretary of Health and Human Services if you believe
that Delta Dental has violated your privacy rights. You may file a complaint with us by
notifying the privacy office as noted below. We will not retaliate against you for filing a
complaint.
Contacts
You may contact the Privacy Department at the address and telephone number listed below
for further information about the complaint process or any of the information contained in this
notice.
Delta Dental Insurance Company
Contracts and Compliance
Attn: Privacy Contact
1000 Mansell Exchange West
Building 100, Suite 100
Alpharetta, Georgia 30022
(800) 521-2651
This notice is effective on and after July 1, 2006.
Delta Dental Insurance Company Delta Dcnta!'s Use ONLY
Group #:
Alpharetta, GA 30022 Group Dental Insurance Application _
(770) 645-8700 AE: Mike Molina
AM: Nancy Gonzalez
Name of Applicant: Monroe County Board of County Commissioners Fed ID/TIN#: 59-6000749
Type of Group: Government Type of Industry: SIC Code:
(employer, association, trust: submit association by-laws or trust agreement)
Address: 1100 Simonton Street, Room 2-268 Key West FL 33040 Monroe
(5trect) (City) (State) (Zip) (County)
Name of Contact Person: Maria Fernandez -Gonzalez Telephone 305-292-4448
Fax No.: 305-292-4452 E-mail Address: Fernandez-Maria@monrcecounty-fl.gov
Billing address if dierent: Contac•t,-
TPA ❑ No ❑ Yes Far: E-mail: Telephone #:
Contract Effective Date: January 1, 2008 Length of Contract: Two Years (Through 12/31/09)
Type of Contract: ® Non Retention ❑ Self Funded ("ASC") ❑ Self Funded with Stop Loss % ❑ Other
Program (check one)
❑ Delta Dental Premier` ("Premier") ❑ Other.
---------------------------------------
® Delta Dental PPO(`PPO")----_----------------------------- Monthl Switchin
- - --------------�'
Fee Basis
- ------$---------
❑ PPO in/PPO out ® PPO "PA out ❑ Table of Allowance #
Type o Dentist
PPO
Premier
Non -Delta
Diagnostic & Preventive
---------------------------------
----------
100%
-------------
100%
---------------
100%
- ----------------------------------------------------------- — ------
❑ Sealants
asic
--------------------------------------
----------
90%
-------------
80%
------ ------
80%
--------------------------------------------------------------------
® Sealants ® Endo ® Perio ® Oral Surgery
Major
--------------------------------------
--=-------
60%
-----=------
50%
-------------
50%
---------- ----------------------------------------------------------
❑ Endo ❑ Perio ❑ Oral Surgery
Benefit Year (check one)
---------------_----------------- ------ ---- ---------------------------------------------------------------
® Calendar Year ❑ Contract Year
Deductible
- -----------------------------------------------------------
$50 per Enrollee; $150 per Family or $ Lifetime
Waived on D&P
® yes ❑ no
----------- -
-------------------
Annual Maximum
--------------------------------------
-
----- -------------------------------------------------------------------------------------------------------
$2,000
Orthodontics (check one)
---------------------------------------------------- -
- --------------------------------- ------
- ---------------
not applicable ❑ adults, children & students ® children and students only ❑ children only
- ----- - ----------------------------
50% I 50% I /o I Lifetime Ortho Max: $1,500 1 Annual Cap: $
Waiting Period
---------------------------- - --------------------------
❑ Basic months ❑ Major months ❑ Orthodontic months
Waiting periods are calculated for each Enrollee from the effective date reported for the Primary Enrollee. ❑ Yes ❑ No
..... .... ... . ............................- ---- - -------- -.-...-------------------------------------------------------
Takeover ❑ yes* ❑ no
---__------------------_-----.-.-..-----._---- .--------- - - - - - ------ I'll --- ------ ----
If yes, previous carrier & takeover period: AIG
*please check applicable boxes and provide history. ❑ Deductible Takeover ❑Maximum Takeover ® Orthodontic Takeover
----------------------------------------------------------
Combined Medical / Dental
------------------------------
❑ yes ® no If yes, name of other carrier:
Dual Choice
❑ yes ® no If yes, name of other carrier:
----------------------------------------------------------------------------------------------------------
❑ y--------
es ®no Missing Tooth Exclusion applies —only teeth extracted under the contract will be covered n-
----- ; ®yesyes ❑ Section-12 125
------------------------------------------------------------
--------------------------------------------Sect--
Special ): Dotic Partner Adden-- - --- ---- -------- ----
Requests (attach page if necessaryDomestic dum Attached
Employer Contribution: ® percentage ❑ dollar amount Employee: 0% Dependent: 0%
Monthly Rates:
❑ Two Tier: EE: $
❑ Three Tier: EE: $
® Four Tier: EE: $31.80
❑ Other (specify type and amount):
EE & family: $
Two Party: $ Three Party.
EE & Spouse: $61.64 EE & ehild(ren): $66.51
If ASC: Per primary member $
EE, Spouse & Child(ren): $96.34
per month or % of claims per month
(Continued on nett page)
GRP-DEN-AP-RL-2006
rev 09/07
Group Dental Application (Continued)
Applicant's Name: Monroe County Board of County
Commissioners
Census: 1,245 # of Eligible Employees
1,130 # of Employees Participating in Delta Dental's Fee -for -Service Program
----------------------------------------------------- 3�------3
-----------------------------------------------------------
hgibility: # of Months: or # of Days: 60 Hours / week: r'
--------st --------- — ---------------------------------------------
----------------------------------------------
Employee Effective Date: ❑ 1' dayof the month following completion of eligibility ❑ Date of hire
--------------------------------------
❑ I' day of month following date of hire ® Day following completion of eli ibili
----ty
------------------
Who is eligible: E All Employees ❑ Class of employees:
® Retired Employees Children to age:
Students to age:
This program shall become effective only upon issuance of a written agreement executed by a duly authorized officer of Delta Dental. In the
absence of fraud or intentional misrepresentation of material fact, the statements in this application are deemed to be representations and not
warranties. Any misrepresentation, omission, concealment of fact or incorrect statement which is material to the acceptance of risk may
prevent recovery if, had the true facts been known to Delta Dental we would not in good faith have issued the contract at the same premium
rate.
Except as otherwise limited by the Health Insurance Portability and Accountability Act and its administrative simplification regulations
("HIPAA"), Applicant shall provide Delta Dental with Protected Health Information ("PHI") for the proper implementation, administration
and management of the group dental services contract for which Applicant is applying. Delta Dental agrees that the PHI will be held
confidential and used or further disclosed only to administer the group dental program as described in the group dental contract or as
permitted or required by law. Applicant and Delta Dental shall comply with all the applicable federal and state laws and regulations relating to administrative simplification, security and privacy of PHI, including the terms of any business associate addendum that may be required
as part of the group dental contract to be executed between Applicant and Delta Dental.
Any person who knowingly and with intent to injure, defraud, or deceive any insurer files a statement of claim or an application containing
any false, incomplete, or misleading information is guilty of a felony of the third degree
Executed this day of G/ 20Q� for the Applicant
Je(` a�
BY Kib r— Signature:
(please print —name and title)
.... -.....
AceeptedforDelta Dental Insurance Company
This day of
Authorizatior initials
at: Lf w
' - t F )0 rt l >
Cands fate
� t
Anthony S. Barth, President, Delta Dental Insurance Company
Agent Information Are you appointed with Delta Dental Insurance Company?
A en Name P y• ❑yes ❑ no
g TIN or SS# State license #
Signature
Address
Telephone #
(i(applicable)
(Street) 10 (State) (riP) (County}
�IONROE COUNTY ATTORNE' -
AP ROVED AS TO FORIA:
LCt c � -
YNTHIA L. HALL
ASSISTANT COUNTY ATTORNEY
4t� Z- - `L 2. - C
GRP-DEN-AP-FIr2006