08/18/2004 Agreement Clot Mille
Cireuit Court Danny L.Kolhage
Office(305)2923560 Fax(306)296 3663
lllemorandllin
To: Celeste Bruno,
Monroe County Health Department
From: Isabel C.DeSantis,Deputy Clerk
Date: Wednesday,October 13,2004
At the Regular BOCC meeting of August 18,2004 the Board approved the
following:
Business Associate Agreement between Monroe County and Monroe County
Health Department in order to share medical information about clients who may be housed
in the Special Needs Shelters.
Enclosed please find a fully executed duplicate original for your handling.
Should you have any questions concerning the above, please do not hesitate to contact
this office.
Copies: Finance
County Attorney
File I
Business Associate.Agreement
This Business Associate Agreement(this"BA. Agreement),dated
2004 is entered into by and between Monroe County Health Department with an address
at 1100 Simonton Street.Key West. FL (the Business Associate)and Monroe County
(the physician's business entity)with an address at 1100 Simonton Street, Key West,FL
(the Covered Entity) (each a Party and collectively the Parties)
The Parties provide for Health Services in Special Needs Shelters. Performance
of service may involve Protected Health Information(as defined in 45 C.F.R 8 164.501)
that is subject to the federal privacy regulations issued pursuant to the Health Insurance
Portability and Accountability Act of 1996("HIPAA")and codified at 45 C.F.R parts
160 and 164 (the"privacy Rule"). The purpose of the B.A. Agreement is to allow for the
Covered Entity's compliance with the Privacy Rule with respect to this Underlying
Agreement.
The Parties hereby agrees as follows:
1. Definitions (Required provisions)
1.1 Unless otherwise specified in this B.A. Agreement, all capitalised terms
used in this B.A. Agreement not otherwise defined have the meaning
established for the purposes of Title 45 parts 160 and 164 of the United
States Code of Federal Regulations, as amended from time to time.
1.2 "PHI" shall mean Protected Health Information,as defined in 45 C.F.R S
164.501, limited to the information received from or created or received
on behalf of Covered Entity.
2. Res onsibilities of Business Associate (Required provisions)
2.1 Except as otherwise specified herein,Business Associate may make any
and all uses and disclosures of PHI necessary to perform obligations under
the Underlying Agreement. With regard to its use and/or disclosure of
PHI, Business Associate agrees to:
a) use and/or disclose PHI only as permitted or required by this
B.A. Agreement or required by law;
N
N ,n b) use appropriate safeguards to prevent use or disclosure of PHI
— other than as permitted or required by this B.A. Agreement;
IC )ti
c a z
c) report to Covered Entity any use or disclosure of PHI of which
c' cn
it becomes aware that is not permitted or required by this B.A.
c - s Agreement;
t:; o Co
- o
I
d) require all its subconfractors and agents that create, receive,
use, disclose or have access to PHI to agree, in writing, to the
same restrictions and conditions on the use and/or disclosure of
PHI that apply to Business Associate;
e) make available its internal practices, books, and records
relating to the use and disclosure of PHI to the Secretary of the
Department of Health and Human Services("I-II-IS") for the
purposes of determining Covered Entity's compliance with the
Privacy Rule;
f) within 15 days(must be less than 60 days)of receiving
a written request from Covered Entity,make available
information necessary for Covered Entity to make an
accounting of disclosures of PHI about and individual;and
g) mitigate,to the extent practicable, any harmful effect that is
known to Business Associate of a use or disclosure of PHI by
Business Associate in violation of the requirements of this B.A.
Agreement.
(Required: choose one as appropriate)
2.2 Option A: The Parties agree that the information in the Business
Associates possession does not constitute a Designated Record Set.
Option B: The Parties agree that the PHI in the Business Associate's
possession constitutes a Designated Record Set. With regard to PHI
maintained in a Designated Record Set, Business Associate agrees to:
a) within ( 5 days(must be less than 30 days)of receiving a written
request from Covered Entity,make available PHI necessary for
Covered Entity to respond to individuals' request for access to PHI
about them; and
b) within 15 days (must be less than 60 days) of receiving a written
request from Covered Entity, incorporate any amendments or
corrections to PHI in accordance with the Privacy Regulation.
3. Permitted Uses and Disclosures of PHI (may be needed by BA in order to
provide services to the physician's practice)
3.1 Unless otherwise limited herein, in addition to any other uses and/or
disclosures permitted or required by this B.A. Agreement or required by
law, Business Associate may:
2
a) use the PHI in its possession for its proper Management and
administration and to fulfill any legal responsibilities of Business
Associate;
b) disclose the PHI in its possession to a third party for the purpose of the
Business Associate's proper management and administration or to
fulfill any legal responsibilities of the Business Associate;provided,
however,that the disclosures are required by law or the Business
Associate has received form the third part written assurances that (i)
the information will be held confidentially and used or further
disclosed only as required by law or for the purpose for which it was
disclosed to the third party;and(ii)the third party will notify the
Business Associate of any instances of which it becomes aware in
which the confidentiality of the information has been breached;
c) perform Data Aggregation for the Health Care Operations of the
Covered Entity;
d) de-identify any and all PHI created or received by the Business
Associate under this B.A. Agreement;provided, however, that the de-
identification conforms to the requirements of the Privacy Rule. Such
resulting de-identified information would not be subject to the terms of
the B.A. Agreement;and
e) create a Limited Data Set and use such Limited Data Set pursuant to a
Data Use Agreement that meets the requirements of the Privacy Rule.
4. Responsibilities of the Covered Entity(Important to comply with HIPAA)
4.1 With regard to the use and/or disclosure of PHI by the Business Associate,
the Covered Entity agrees:
a) to obtain any consent, authorization or permission that may be
required by the Privacy Rule or applicable state laws and/or
regulations prior to furnishing Business Associate the PHI pertaining
to the individual; and
3
b) that it will inform Business Associate of any PHI that is subject to any
arrangements permitted or required of the Covered Entity under the
Privacy Rule that may materially impact in any manner the use and/or
Disclosure of PHI by the Business Associate under this B.A.
Agreement, including, but not limited to, restrictions on the use and/or
disclosure of PHI as provided for in 45 C.F.R b 164.522 and agreed to by
Covered Entity.
5. B.A. Agreement Effective Date
5.1 Each term and condition of this B.A. Agreement shall be effective on the
compliance date applicable to the Covered Entity under the Privacy Rule
(B.A. Effective Date).
6. Term and Termination(Required provisions)
6.1 Termination by the Covered Entity Upon Covered Entity's determination
of a breach of a material term of this B.A. Agreement by the Business
Associate, the Covered Entity shall provide the Business Associate written
notice of that breach in sufficient detail to enable Business associate to
understand the specific nature of that breach and afford Business
Associate an opportunity to cure the breach;provided, however, that if
Business Associate fails to cure the breach within a reasonable time
specified by Covered Entity, Covered Entity may terminate this B.A.
Agreement and the Underlying Agreement to the extent that the
Underlying Agreement requires the Business Associate to create or
receive PHI.
6.2 Effect of Termination or Expiration Within 3 0 days of the termination
or expiration of this B.A. Agreement, the Business Associate agrees to
return or destroy all PHI, including such information in possession of the
Business Associate's subcontractors, if feasible to do so. If return or
destruction of said PHI is not feasible,the Business Associate agrees to
extend any and all protections, limitations and restrictions contained in
this B.A. Agreement to Business Associate's use and/or disclosure of any
PHI retained after the termination or expiration of this B.A. Agreement,
and to limit any further uses and/or disclosures to the purposes that make
return or destruction of the PHI infeasible. This Section 6.2 shall survive
any termination or expiration of this B.A. Agreement.
7. Miscellaneous(Important for legal purposes and clarity- These provisions and
any additional requirements should be discussed with your legal advisor)
7.1 Change in Law. The Parties agree to negotiate to amend this B.A.
4
Agreement as necessary to comply with any amendment to any provision
of HIPAA or its implementing regulations set forth at 45 C.F.R parts 160
and 164, including, but not limited to, The Privacy regulation, which
materially alters either Parties or both Parties obligations under this B.A.
Agreement.
7.2 Construction of Terms. The terms of this B.A. Agreement shall be
construed in light of any applicable interpretation or guidance on HIPAA
and/or Privacy Regulation issued by HHS or the Office of Civil Rights
("OCR")from time to time.
7.3 No Third Party Beneficiaries Nothing in this B.A.Agreement shall
confer upon any person other than the parties and their respective
successors or assigns, any rights, remedies,obligations, or liabilities
whatsoever.
7.4 Contradictory Terms Any provision of the Underlying Agreement that is
directly contradictory to one or more terms of this B.A.Agreement
("Contradictory Term") shall be superceded by the terms of this B,A.
Agreement as of the Amendment Effective Date to the extent and only to
the extent of the contradiction, only for the purpose of the Covered
Entity's compliance with the Privacy Rule and only to the extent that it is
reasonably impossible to comply with both the Contradictory term and the
terms of this B.A. Agreement.
IN WITNESS WHEREOF, each of the undersigned has caused this B.A. Agreement to
be duly executed in its name and on its behalf effective as of au". It. 2004.
COVEREA� BUSINESS ASSOCIATE
C.By: By. M D
Print Name Maki i- PI1G-907Y Print Name: 5usana Mal
Print Title: `` II�p D reap r
/✓� I� Print Title: n,on.oe ctunry 14e1.4 Opt.
Date: Rek/171 Date: /O/(p /O y
., c - 1I�3� ��Pm.
(REAL)
2A I gNUr1 A RES" L KOWAGE, QERK
5315tAKT� I�/ V P4_Y.-. n
�Y Q. DEPUTY CLERK
5