Okaloosa County BOCC — October 15, 2013 — ADPI 3rd Contract Amendment — reading text

than a routine billing inquiry, Business Associate shall forward a copy of such request to Covered Entity and shall fully cooperate with Covered Entity in responding to such request. In either case, a denial of access to requested PHI shall not be made without the prior written consent of Covered Entity. Access _to Electronic Health Records. lf Business Associate is deemed to use or maintain an Electronic Health Record on behalf of Covered Entity with respect to PHI, then, to the extent an Individual has the right to request a copy of the PHI maintained in such Electronic Health Record pursuant to 45 CFR § 164.524 and makes such a request to Business Associate, Business Associate shall provide such Individual with a copy of the information contained in such Electronic Health Record in an electronic format and, if the Individual so chooses, transmit such copy directly to an entity or person designated by the Individual. Business Associate may charge a fee to the Individual for providing a copy of such information, but such fee may not exceed Business Associate’s labor costs in responding to the request for the copy. The provisions of 45 CFR § 164.524, including the exceptions to the requirement to provide a copy of PHI, shall otherwise apply and Business Associate shall comply therewith as if Business Associate were the “covered entity,” as such term is defined in HIPAA. At Covered Entity’s request, Business Associate shall provide Covered Entity with a copy of an Individual’s PHI maintained in an Electronic Health Record in an electronic format and in a time and manner designated by Covered Entity in order for Covered Entity to comply with 45 CFR § 164.524, as amended by the HITECH Act. Amendment of PHI. Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that Covered Entity directs or agrees to pursuant to 45 CFR § 164.526 at the request of Covered Entity or an Individual, and in the time and manner designated by Covered Entity. Accounting Rights. This Section 5.d is subject to Section 5.e below. Business Associate shall make available to Covered Entity, in response to a request from an Individual, information required for an accounting of disclosures of PHI with respect to the Individual, in accordance with 45 CFR § 164.528, incorporating exceptions to Page 5 of 12 Exhibit A such accounting designated under such regulation. Such accounting is limited to disclosures that were made in the six (6) years prior to the request and shall not include any disclosures that were made prior to the compliance date of the HIPAA Regulations. Business Associate shall provide such information as is necessary to provide an accounting within ten (10) days of Covered Entity’s request. Such accounting must be provided without cost to the Individual or to Covered Entity if it is the first accounting requested by an Individual within any twelve (12) month period; however, a reasonable, cost-based fee may be charged for subsequent accountings if Business Associate informs Covered Entity and Covered Entity informs the Individual in advance of the fee, and the individual is afforded an opportunity to withdraw or modify the request. Such accounting obligations shall survive termination of this Agreement and shall continue as long as Business Associate maintains PHI. Accounting of Disclosures of Electronic Health Records. The provisions of this Section 5.e shall be effective on the date specified in the HITECH Act. If Business Associate is deemed to use or maintain an Electronic Health Record on behalf of Covered Entity, then, in addition to complying with the requirements set forth in Section 5.d above, Business Associate shall maintain an accounting of any Disclosures made through such Electronic Health Record for Treatment, Payment and Health Care Operations, as applicable. Such accounting shall comply with the requirements of the HITECH Act. Upon request by Covered Entity, Business Associate shall provide such accounting to Covered Entity in the time and manner specified by Covered Entity and in compliance with the HITECH Act. Alternatively, if Covered Entity responds to an Individual’s request for an accounting of Disclosures made through an Electronic Health Record by providing the requesting Individual with a list of all business associates acting on behalf of Covered Entity, then Business Associate shall provide such accounting directly to the requesting Individual in the time and manner specified by the HITECH Act. Agreement to Restrict Disclosure. If Covered Entity is required to comply with a restriction on the Disclosure of PHI pursuant to Section 13405 of the HITECH Act, then Covered Entity shall, to the extent necessary to comply with such restriction, provide written notice to Business Associate of the name of the Individual requesting the restriction and the PHI affected thereby. Business Associate shall, upon receipt of such notification, not Disclose the identified PHI to any health plan for the purposes of carrying out Payment or Health Care Operations, except as otherwise required Page 6 of 12 6. Exhibit A by law. Covered Entity shall also notify Business Associate of any other restriction to the Use or Disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522. Remuneration and Marketing. a. Remuneration for PHI. This Section 6.a shall be effective with respect to exchanges of PHI occurring six (6) months after the date of the promulgation of final regulations implementing the provisions of Section 13405(d) of the HITECH Act. On and after such date, Business Associate agrees that it shall not, directly or indirectly, receive remuneration in exchange for any PH! of Covered Entity except as otherwise permitted by the HITECH Act. b. Limitations on Use of PHI! for Marketing Purposes. Business Associate shall not Use or Disclose PHI for the purpose of making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service, unless such communication: (1) complies with the requirements of subparagraph (i), (ii) or (iii) of paragraph (1) of the definition of marketing contained in 45 CFR § 164.501, and (2) complies with the requirements of subparagraphs (A), (B) or (C) of Section 13406(a)(2) of the HITECH Act, and implementing regulations or guidance that may be issued or amended from time to time. Covered Entity agrees to assist Business Associate in determining if the foregoing requirements are met with respect to any such marketing communication. Governmental Access to Records. Business Associate shall make its internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining Covered Entity’s compliance with the HIPAA Regulations and the HITECH Act. Except to the extent prohibited by law, Business Associate agrees to notify Covered Entity of all requests served upon Business Associate for information or documentation by or on behalf of the Secretary. Business Associate shall provide to Covered Entity a copy of any PHI that Business Associate provides to the Secretary concurrently with providing such PHI to the Secretary. Minimum Necessary. To the extent required by the HITECH Act, Business Associate shall limit its Use, Disclosure or request of PHI to the Limited Data Set or, if needed, to the minimum necessary to accomplish the intended Use, Disclosure or request, respectively. Effective on the date the Secretary issues guidance on what constitutes “minimum necessary’ for purposes of the HIPAA Regulations, Business Associate Page 7 of 12 10. Exhibit A shall limit its Use, Disclosure or request of PHI to only the minimum necessary as set forth in such guidance. State Privacy Laws. Business Associate shall comply with state laws to extent that such state privacy laws are not preempted by HIPAA or the HITECH Act. Termination. a. Breach by Business Associate. if Covered Entity knows of a pattern of activity or practice of Business Associate that constitutes a material breach or violation of Business Associate’s obligations under this Agreement, then Covered Entity shall promptly notify Business Associate. With respect to such breach or violation, Business Associate shall take reasonable steps to cure such breach or end such violation, if possible. If such steps are either not possible or are unsuccessful, upon written notice to Business Associate, Covered Entity may terminate its relationship with Business Associate. Breach by Covered Entity. If Business Associate knows of a pattern of activity or practice of Covered Entity that constitutes a material breach or violation of Covered Entity’s obligations under this Agreement, then Business Associate shall promptly notify Covered Entity. With respect to such breach or violation, Covered Entity shall take reasonable steps to cure such breach or end such violation, if possible. If such steps are either not possible or are unsuccessful, upon written notice to Covered Entity, Business Associate may terminate its relationship with Covered Entity. Effect of Termination. Upon termination of this Agreement for any reason, Business Associate shall either return or destroy all PHI, as requested by Covered Entity, that Business Associate or its agents or subcontractors still maintain in any form, and shall retain no copies of such PHI. If Covered Entity requests that Business Associate return PH!, such PHI shall be returned in a mutually agreed upon format and timeframe. If Business Associate reasonably determines that return or destruction is not feasible, Business Associate shall continue to extend the protections of this Agreement to such PHI, and Jimit further uses and disclosures of such PHI to those purposes that make the return or destruction of such PHI not feasible. If Business Associate is asked to destroy the PHI, Business Associate shall destroy PHI in a manner that renders the PHI unusable, unreadable or indecipherable to unauthorized persons as specified in the HITECH Act. Page 8 of 12 11. 12. 13. 14. 15. 16. 17. Exhibit A Amendment. The parties acknowledge that state and federal laws relating to data security and privacy are rapidly evolving and that amendment of this Agreement may be required to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement any new or modified standards or requirements of HIPAA, the HIPAA Regulations, the HITECH Act and other applicable laws relating to the security or confidentiality of PHI. Upon the request of Covered Entity, Business Associate agrees to promptly enter into negotiation concerning the terms of an amendment to this Agreement incorporating any such changes. No Third Party Beneficiaries. Nothing express or implied in this Agreement is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. Effect on Underlying Arrangement. In the event of any conflict between this Agreement and any underlying arrangement between Covered Entity and Business Associate, the terms of this Agreement shall control. Survival. The provisions of this Agreement shall survive the termination or expiration of any underlying arrangement between Covered Entity and Business Associate. Interpretation. This Agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA Regulations and the HITECH Act. The parties agree that any ambiguity in this Agreement shall be resolved in favor of a meaning that complies and is consistent with such laws. Governing Law. This Agreement shall be construed in accordance with the laws of the State of Florida. Notices. All notices required or permitted under this Agreement shall be in