Okaloosa County BOCC — October 15, 2013 — ADPI 3rd Contract Amendment — reading text

AMENDMENT 3 TO EMS BILLING CONTRACT This amendment made and entered into this day of 2013, applies to the “EMS Billing Services” contract dated May 18, 2004, and amended November 4, 2008, and May 18, 2010, by and between Okaloosa County, Florida, hereinafter referred to as the “COUNTY”, and Advanced Data Processing, Inc., hereinafter referred to as the ‘CONTRACTOR’. Paragraph 11 of the contract is amended as follows: 11. ATTACHMENTS. A. Business Associate Addendum (Exhibit A attached hereto): Replace Exhibit A with attached revision. B. Scope of Work (Exhibit B): Specific Scope Compliance, Paragraph 7, Page 2 of 3, is amended as follows: 7. Retain all accounts for a minimum of six (6) months (unless otherwise specified by mutual agreement) turning over accounts which no collection has been made (unless insurance payment is pending). ATTEST: OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS Gary Stanford Don R. Amunds, Chairman Deputy Clerk of Courts Board of County Commissioners WITNESS: CONTRACTOR Advanced Data Processing, Inc. Mag 2 = BY: Loacthhlbea Base We Maas Title: Cd 2 YP EXHIBIT A BUSINESS ASSOCIATE ADDENDUM This Business Associate Agreement (“Agreement’) is entered into between OKALOOSA COUNTY (‘Covered Entity’) and Advanced Data Processing, Inc., on behalf of itself and its subsidiaries and affiliates (‘Business Associate”), effective as of September 23, 2013, or such earlier date as the Agreement is executed by both parties (the “Effective Date”). WHEREAS, Covered Entity and Business Associate have entered into, or plan to enter into, an arrangement pursuant to which Business Associate may provide services for Covered Entity that require Business Associate to access, create and use Protected Health information (‘PHI’) that is confidential under state and/or federal law; and WHEREAS, Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed by Covered Entity to Business Associate, or collected or created by Business Associate, in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), and the regulations promulgated there under, including, without limitation, the regulations codified at 45 CFR Parts 160 and 164 (“HIPAA Regulations”); the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009, and its implementing regulations and guidance issued by the Secretary of the Department of Health and Human Services (the “Secretary’) (the “HITECH Act”); and other applicable state and federal laws, all as amended from time to time, including as amended by the Final Rule issued by the Secretary on January 17, 2013 titled “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules”; and WHEREAS, the HIPAA Regulations require Covered Entity to enter into an agreement with Business Associate meeting certain requirements with respect to the Use and Disclosure of PHI, which are met by this Agreement. NOW, THEREFORE, in consideration of the mutual promises contained herein and the exchange of information pursuant to this Agreement, the parties agree as follows: 1. Definitions. Capitalized terms used herein without definition shall have the meanings ascribed to them in the HIPAA Regulations or the HITECH Act, as applicable unless otherwise defined herein. 2. Obligations of Business Associate. Exhibit A Page 1 of 12 Exhibit A Permitted Uses and Disclosures. Business Associate shall only Use or Disclose PHI for the purposes of (i) performing Business Associate’s obligations under Exhibit A of this Agreement (“Exhibit A’) and as permitted by this Agreement; or (ii) as permitted or Required By Law; or (iii) as otherwise permitted by this Agreement. Business Associate shall not Use or further Disclose PHI other than as permitted or required by this Agreement or as Required By Law. Further, Business Associate shall not Use or Disclose PHI in any manner that would constitute a violation of the HIPAA Regulations or the HITECH Act if so used by Covered Entity, except that Business Associate may Use PHI (i) for the proper management and administration of Business Associate; and (ii) to carry out the legal responsibilities of Business Associate. Business Associate may Disclose PHI for the proper management and administration of Business Associate, to carry out its legal responsibilities or for payment purposes as specified in 45 CFR § 164.506(c)(1) and (3), including but not limited to Disclosure to a business associate on behalf of a covered entity or health care provider for payment purposes of such covered entity or health care provider, with the expectation that such parties will provide reciprocal assistance to Covered Entity, provided that with respect to any such Disclosure either: (i) the Disclosure is Required By Law; or (ii) for permitted Disclosures when Required By Law, Business Associate shall obtain a written agreement from the person to whom the PHI is to be Disclosed that such person will hold the PHI in confidence and will not use and further disclose such PHI except as Required By Law and for the purpose(s) for which it was Disclosed by Business Associate to such person, and that such person will notify Business Associate of any instances of which it is aware in which the confidentiality of the PHI has been breached. Appropriate Safequards. Business Associate shall implement administrative, physical and technical safeguards that (i) reasonably and appropriately protect the confidentiality, integrity and availability of electronic PHI that it creates, receives, maintains or transmits on behalf of Covered Entity; and (ii) prevent the Use or Disclosure of PH! other than as contemplated by Exhibit A and this Agreement. Compliance with Security Provisions. Business Associate shall: (i) implement and maintain administrative safeguards as required by 45 CFR § 164.308, physical safeguards as required by 45 CFR § 164.310 and technical safeguards as required by 45 CFR § 164.312; (ii) implement and document reasonable and appropriate policies and procedures as required by 45 CFR § 164.316; and (iii) be in compliance with all requirements of the Page 2 of 12 3. Exhibit A HITECH Act related to security and applicable as if Business Associate were a “covered entity,” as such term is defined in HIPAA. Compliance with Privacy Provisions. Business Associate shall only Use and Disclose PHI in compliance with each applicable requirement of 45 CFR § 164.504(e). Business Associate shall comply with all requirements of the HITECH Act related to privacy and applicable as if Business Associate were a “covered entity,” as such term is defined in HIPAA. To the extent Business Associate is to carry out one or more of Covered Entity’s obligation(s) under Subpart E of 45 CFR Part 164, Business Associate shall comply with the requirements of Subpart E that apply to Covered Entity in the performance of such obligation(s). Duty to Mitigate. Business Associate agrees to mitigate, to the extent practicable and mandated by law, any harmful effect that is known to Business Associate of a Use or Disclosure of PHI by Business Associate in violation of the requirements of this Agreement. Encryption. To facilitate Business Associate’s compliance with this Agreement and to assure adequate data security, Covered Entity agrees that all PHI provided or transmitted to Business Associate pursuant to Exhibit A shall be provided or transmitted in a manner which renders such PHI unusable, unreadable or indecipherable to unauthorized persons, through the use of a technology or methodology specified by the Secretary in the guidance issued under section 13402(h)(2) of the HITECH Act. Covered Entity acknowledges that failure to do so could contribute to or permit a Breach requiring patient notification under the HITECH Act and further agrees that Business Associate shall have no liability for any Breach caused by such failure. Reporting. a. Security Incidents and/or Unauthorized Use or Disclosure. Business Associate shall report to Covered Entity a successful Security Incident or any Use and/or Disclosure of PHI other than as provided for by this Agreement or permitted by applicable law within a reasonable time of becoming aware of such Security Incident and/or unauthorized Use or Disclosure (but not later than ten (10) days thereafter), in accordance with the notice provisions set forth herein. Business Associate shall take (i) prompt action to cure any such deficiencies as reasonably requested by Covered Entity, and (ii) any action pertaining to such Security Incident and/or Page 3 of 12 Exhibit A unauthorized Use or Disclosure required by applicable federal and state laws and regulations. If such successful Security Incident or unauthorized Use or Disclosure results in a Breach as defined in the HITECH Act, then Covered Entity shall comply with the requirements of Section 3.b below. Breach of Unsecured PHI. The provisions of this Section 3.b are effective with respect to the Discovery of a Breach of Unsecured PHI occurring on or after September 23, 2009. With respect to any unauthorized acquisition, access, Use or Disclosure of Covered Entity’s PHI by Business Associate, its agents or subcontractors, Business Associate shall (i) investigate such unauthorized acquisition, access, Use or Disclosure; (ii) determine whether such unauthorized acquisition, access, Use or Disclosure constitutes a reportable Breach under the HITECH Act; and (iii) document and retain its findings under clauses (i) and (ii). If Business Associate Discovers that a reportable Breach has occurred, Business Associate shall notify Covered Entity of such reportable Breach in writing within thirty (30) days of the date Business Associate Discovers such Breach. Business Associate shall be deemed to have discovered a Breach as of the first day that the Breach is either known to Business Associate or any of its employees, officers or agents, other than the person who committed the Breach, or by exercising reasonable diligence should have been known to Business Associate or any of its employees, officers or agents, other than the person who committed the Breach. To the extent the information is available to Business Associate, Business Associate’s written notice shall include the information required by 45 CFR § 164.410(c). Business Associate shall promptly supplement the written report with additional information regarding the Breach as it obtains such information. Business Associate shall cooperate with Covered Entity in meeting Covered Entity’s obligations under the HITECH Act with respect to such Breach. Business Associate’s Agents. To the extent that Business Associate uses one or more subcontractors or agents to provide services under Exhibit A, and such subcontractors or agents receive or have access to PHI, Business Associate shall sign an agreement with such subcontractors or agents containing substantially the same provisions as this Agreement. Rights of individuals. a. Access to PHI. Within ten (10) days of receipt of a request by Covered Entity, Business Associate shall make PHI maintained in a Designated Record Set available to Covered Entity or, as directed by Covered Entity, to an Individual to enable Covered Entity to fulfill Page 4 of 12 Exhibit A its obligations under 45 CFR § 164.524. Subject to Section 5.b below, (i) in the event that any Individual requests access to PHI directly from Business Associate in connection with a routine billing inquiry, Business Associate shall directly respond to such request in compliance with 45 CFR § 164.524; and (ji) in the event such request appears to be for a purpose other