Okaloosa County BOCC — May 20, 2014 — Intermedix EMS Billing Contract 2014 — reading text

response to a request from an Individual, information required for an accounting of disclosures of PHI with respect to the Individual, in accordance with 45 CFR § 164.528, incorporating exceptions to such accounting designated under such regulation. Such accounting is limited to disclosures that were made in the six (6) years prior to the request and shall not include any disclosures that were made prior to the compliance date of the HIPAA Regulations. Business Associate shall provide such information as is necessary to provide an accounting within ten (10) days of Covered Entity’s request. Such accounting must be provided without cost to the Individual or to Covered Entity if it is the first accounting requested by an Individual within any twelve (12) month period; however, a reasonable, cost-based fee may be charged for subsequent accountings if Business Associate informs Covered Entity and Covered Entity informs the Individual in advance of the fee, and the Individual is afforded an opportunity to withdraw or modify the request. Such accounting obligations shall survive termination of this BA Agreement and shall continue as long as Business Associate maintains PHI. e Accounting of Disclosures of Electronic Health Records. The provisions of this Section 5.e shall be effective on the date specified in the HITECH Act. If Business Associate is deemed to use or maintain an Electronic Health Record on behalf of Covered Entity, then, in addition to complying with the requirements set forth in Section 5.d above, Business Associate shall maintain an accounting of any Disclosures made through such Electronic Health Record for Treatment, Payment and Health Care Operations, as applicable. Such accounting shall comply with the requirements of the HITECH Act. Upon request by Covered Entity, Business Associate shall provide such accounting to Covered Entity in the time and manner specified by Covered Entity and in compliance with the HITECH Act. Alternatively, if Covered Entity responds to an Individual’s request for an accounting of Disclosures made through an Electronic Health Record by providing the requesting Individual with a list of all business associates acting on behalf of Covered Entity, then Business Associate shall provide such accounting directly to the requesting Individual in the time and manner specified by the HITECH Act. f. Agreement to Restrict Disclosure. If Covered Entity is required to comply with a restriction on the Disclosure of PHI pursuant to Section 13405 of the HITECH Act, then Covered Entity shall, to the extent necessary to comply with such restriction, provide written notice to Business Associate of the name of the Individual requesting the restriction and the PHI affected thereby. Business Associate shall, upon receipt of such notification, not Disclose the identified PHI to any health pian for the purposes of carrying out Payment or Health Care Operations, except as otherwise required by law. Covered Entity shall also notify Business Associate of any other restriction to the Use or Disclosure of PHI that Covered Entity has agreed to in accordance with 45 CFR § 164.522. 6. Remuneration and Marketing. a Remuneration for PHI. This Section 6.a shall be effective with respect to exchanges of PHI occurring six (6) months after the date of the promulgation of final regulations implementing the provisions of Section 13405(d) of the HITECH Act. On and after such date, Business Associate agrees that it shall not, directly or indirectly, receive remuneration in exchange for any PHI of Covered Entity except as otherwise permitted by the HITECH Act. b. Limitations on Use of PHI for Marketing Purposes. Business Associate shall not Use or Disclose PHI for the purpose of making a communication about a product or service that encourages recipients of the communication to purchase or use the product or service, unless such communication: (i) complies with the requirements of subparagraph (i), (ii) or Git) of paragraph (1) of the definition of marketing contained in 45 CFR § 164.501; and (ii) complies with the requirements of subparagraphs (A), (B) or (C) of Section 13406(a)(2) of the HITECH Act, and implementing regulations or guidance that may be issued or amended from time to time. Covered Entity agrees to assist Business Associate in determining if the foregoing requirements are met with respect to any such marketing communication. 7. Governmental Access to Records. Business Associate shall make its internal practices, books and records relating to the Use and Disclosure of PHI available to the Secretary for purposes of determining Covered Entity’s compliance with the HIPAA Regulations and the HITECH Act. Except to the extent prohibited by law, Business Associate agrees to notify Covered Entity of all requests served upon Business Associate for information or documentation by or on behalf of the Secretary. Business Associate shall provide to Covered Entity a copy of any PHI that Business Associate provides to the Secretary concurrently with providing such PHI to the Secretary. 8. Minimum Necessary. To the extent required by the HITECH Act, Business Associate shall limit its Use, Disclosure or request of PHI to the Limited Data Set or, if needed, to the minimum necessary to accomplish the intended Use, Disclosure or request, respectively. Effective on the date the Secretary issues guidance on what constitutes “minimum necessary” for purposes of the HIPAA Regulations, Business Associate shall limit its Use, Disclosure or request of PHI to only the minimum necessary as set forth in such guidance. 9. State Privacy Laws. Business Associate shall comply with state laws to extent that such state privacy laws are not preempted by HIPAA or the HITECH Act. 10. Termination. a. Breach by Business Associate. If Covered Entity knows of a pattern of activity or practice of Business Associate that constitutes a material breach or violation of Business Associate’s obligations under this BA Agreement, then Covered Entity shall promptly notify Business Associate. With respect to such breach or violation, Business Associate shall take reasonable steps to cure such breach or end such violation, if possible. If such steps are either not possible or are unsuccessful, upon written notice to Business Associate, Covered Entity may terminate its relationship with Business Associate. b. Breach by Covered Entity. If Business Associate knows of a pattern of activity or practice of Covered Entity that constitutes a material breach or violation of Covered Entity’s obligations under this BA Agreement, then Business Associate shall promptly notify Covered Entity. With respect to such breach or violation, Covered Entity shall take reasonable steps to cure such breach or end such violation, if possible. If such steps are either not possible or are unsuccessful, upon written notice to Covered Entity, Business Associate may terminate its relationship with Covered Entity. c. Effect_of Termination. Upon termination of this BA Agreement for any reason, Business Associate shall either return or destroy all PHI, as requested by Covered Entity, that Business Associate or its agents or subcontractors still maintain in any form, and shall retain no copies of such PHI. If Covered Entity requests that Business Associate return PHI, such PHI shall be returned in a mutually agreed upon format and timeframe. If Business Associate reasonably determines that return or destruction is not feasible, Business Associate shall continue to extend the protections of this BA Agreement to such PHI, and limit further uses and disclosures of such PHI to those purposes that make the return or destruction of such PHI not feasible. If Business Associate is asked to destroy the PHI, Business Associate shall destroy PHI in a manner that renders the PHI unusable, unreadable or indecipherable to unauthorized persons as specified in the HITECH Act. il. Amendment. The parties acknowledge that state and federal laws relating to data security and privacy are rapidly evolving and that amendment of this BA Agreement may be required to ensure compliance with such developments. The parties specifically agree to take such action as is necessary to implement any new or modified standards or requirements of HIPAA, the HIPAA Regulations, the HITECH Act and other applicable laws relating to the security or privacy of PHI. Upon the request of Covered Entity, Business Associate agrees to promptly enter into negotiation concerning the terms of an amendment to this BA Agreement incorporating any such changes. 12. No Third Party Beneficiaries. Nothing express or implied in this BA Agreement is intended to confer, nor shall anything herein confer, upon any person other than Covered Entity, Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. 13. Effect _on Underlying Agreement. In the event of any conflict between this BA Agreement and the Underlying Agreement, the terms of this BA Agreement shall control. 14. Survival, The provisions of this BA Agreement shall survive the termination or expiration of the Underlying Agreement. 15. Interpretation, This BA Agreement shall be interpreted as broadly as necessary to implement and comply with HIPAA, the HIPAA Regulations and the HITECH Act. The parties agree that any ambiguity in this BA Agreement shall be resolved in favor of a meaning that complies and is consistent with such laws. 16. Governing Law. To the extent this BA Agreement is not governed by federal law, this BA Agreement shall be construed in accordance with the laws of the State of Florida. 17. Notices. All notices required or permitted under this BA Agreement shall be in writing and sent to the other party as directed below or as otherwise directed by either party, from time to time, by written notice to the other. All such notices shall be deemed validly given upon receipt of such notice by certified mail, postage prepaid, facsimile transmission, e-mail or personal or courier delivery: If to Covered Entity: Okaloosa County Attn: Dino Villani, Public Safety Director Public Safety Department 90 College Blvd., East Niceville, FL 32578 Tel: 850-651-7150 Email: dvillani@co.okaloosa.fl.us With a copy to: Joanne Kublik Contracts & Leases Okaloosa County Purchasing Department 602-C N. Pearl Street Crestview, FL 32536 Tel: 850-689-5960 Fax: 850-689-5032 E-Mail: jkublik@co.okaloosa,fl.us If to Business Associate: Intermedix Corporation 6451 N. Federal Highway, Suite 1000 Ft. Lauderdale, FL 33308 Attn: Gregg Bloom, Chief Compliance Officer Telephone: 954-308-8702 Fax: 954-308-8725 Email Address: gregg.bloom@intermedix.com Exhibit C Optional Services Intermedix will provide the following specific optional services by mutual written agreement between Intermedix and Client: 1. Provide HIPAA-compliant Notice of Privacy Practices to transported, billed patients as an insert into the initial billing notice mailed to these patients. 2. If Client has purchased TripTix® product pursuant to the terms and conditions of the Addendum to this Agreement, Intermedix shall provide TripTix® based reporting extract of data required by state or local regulatory authorities connectivity/interface in a format reasonably required by the such authorities. Exhibit D (TripTix® Program) This Exhibit D, effective as of the Effective Date of the Agreement, hereby sets forth terms and conditions that apply only to the Product and Product Units listed in this Exhibit D. In regards to the Product, to the extent the terms and conditions of the Agreement are in conflict with this Exhibit D, the terms of this Exhibit D shall control. Where not different or in conflict with the terms, conditions and definitions of this Exhibit D, all applicable terms, conditions, and definitions set forth in the Agreement are incorporated within this Exhibit D as if set forth herein. Capitalized terms