Okaloosa County BOCC — September 16, 2014 — Medical Director Contract Amendment — reading text

AMENDMENT 1 TO MEDICAL DIRECTOR CONTRACT CONTRACT #C09-1721-PS This amendment made and entered into this day of 2014, applies to the “Medical Director’ contract dated September 18, 2012, by and between OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS, and DR. CHRISTOPHER D. TANNER, M.D. The contract is amended as follows: The Business Associate Addendum is attached to the Medical Director contract as Exhibit A. ATTEST: OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS Gary Stanford Charles K. Windes, Jr., Chairman Deputy Clerk of Courts Board of County Commissioners ATTEST: MEDICAL DIRECTOR Mth Ebb UX anne EO Miehall é Haber Dr. Christopher D. Tanner, M.D. EXHIBIT A BUSINESS ASSOCIATE ADDENDUM This Business Associate Agreement (“Agreement”) is entered into between OKALOOSA COUNTY BOARD OF COUNTY COMMISSIONERS (“Covered Entity’) and DR. CHRISTOPHER D. TANNER, M.D., (“Business Associate”), effective as of September 16, 2014. WHEREAS, Covered Entity and Business Associate have entered into, or plan to enter into, an arrangement pursuant to which Business Associate may provide services for Covered Entity that require Business Associate to access, create and use Protected Health Information (“PHI”) that is confidential under state and/or federal law; and WHEREAS, Covered Entity and Business Associate intend to protect the privacy and provide for the security of PHI disclosed by Covered Entity to Business Associate, or collected or created by Business Associate, in compliance with the Health Insurance Portability and Accountability Act of 1996, Public Law 104-191 (“HIPAA”), and the regulations promulgated there under, including, without limitation, the regulations codified at 45 CFR Parts 160 and 164 (“HIPAA Regulations”); the Health Information Technology for Economic and Clinical Health Act, as incorporated in the American Recovery and Reinvestment Act of 2009, and its implementing regulations and guidance issued by the Secretary of the Department of Health and Human Services (the “Secretary”) (the “HITECH Act”); and other applicable state and federal laws, all as amended from time to time, including as amended by the Final Rule issued by the Secretary on January 17, 2013 titled “Modifications to the HIPAA Privacy, Security, Enforcement, and Breach Notification Rules under the Health Information Technology for Economic and Clinical Health Act and the Genetic Information Nondiscrimination Act; Other Modifications to the HIPAA Rules”; and WHEREAS, the HIPAA Regulations require Covered Entity to enter into an agreement with Business Associate meeting certain requirements with respect to the Use and Disclosure of PHI, which are met by this Agreement. NOW, THEREFORE, in consideration of the mutual promises contained herein and the exchange of information pursuant to this Agreement, the parties agree as follows: A. General Provisions: 1. Meaning of Terms. The terms used in this Agreement shall have the same meaning as those terms defined in HIPAA. 2. Regulatory References. Any reference in this Agreement to a regulatory section means the section currently in effect or as amended. Exhibit A Page 1 of 4 3. Interpretation. Any ambiguity in this Agreement shall be interpreted to permit compliance with HIPAA. B. Obligations of Business Associate: 1. Exhibit A Not use or further disclose PHI other than as permitted or required by this Agreement or as required by law; Use appropriate safeguards and comply, where applicable, with the HIPAA Security Rule with respect to electronic protected health information (“e-PHI”) and implement appropriate physical, technical and administrative safeguards to prevent use or disclosure of PHI other than as provided for by this Agreement; Report to Covered Entity any use or disclosure of PHI not provided for by this Agreement of which it becomes aware, including any security incident (as defined in the HIPAA Security Rule) and any breaches of unsecured PHI as required by 45 CFR §164.410. Breaches of unsecured PHI shall be reported to Covered Entity without unreasonable delay but in no case later than 60 days after discovery of the breach; In accordance with 45 CFR 164.502(e)(1\ii) and 164.308(b)(2), ensure that any subcontractors that create, receive, maintain, or transmit PHI on behalf of Business Associate agree to the same restrictions, conditions, and requirements that apply to Business Associate with respect to such information; Take PHI in a designated record set available to Covered Entity and to an individual who has a right of access in a manner that satisfies Covered Entity’s obligations to provide access to PHI in accordance with 45 CFR §164.524 within 30 days of a request; Make any amendment(s) to PHI in a designated record set as directed by Covered Entity, or take other measures necessary satisfy Covered Entity’s obligations under 45 CFR §164.526; Maintain and make available information required to provide an accounting of disclosures to Covered Entity or an individual who has a right to an accounting within 60 days and as necessary to satisfy Covered Entity’s obligations under 45 CFR §164.528; To the extent that Business Associate is to carry out any of Covered Entity’s obligations under the HIPAA Privacy Rule, Business Associate shall comply with the requirements of the Privacy Rule that apply to Covered Entity when it carries out that obligation; Page 2 of 4 9. 10. 11. Make its internal practices, books, and records relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to the Secretary of the Department of Health and Human Services for purposes of determining Business Associate's and Covered Entity’s compliance with HIPAA and the HITECH Act; Restrict the use or disclosure of PHI if Covered Entity notifies Business Associate of any restriction on the use or disclosure of PHI that Covered Entity has agreed to or is required to abide by under 45 CFR §164.522; and If Covered Entity is subject to the Red Flags Rule (found at 16 CFR §681.1 et seq.), Business Associate agrees to assist Covered Entity in complying with its Red Flags Rule obligations by: (a) implementing policies and procedures to detect relevant Red Flags (as defined under 16 C.F.R. §681.2); (b) taking all steps necessary to comply with the policies and procedures of Covered Entity’s Identity Theft Prevention Program; (c) ensuring that any agent or third party who performs services on its behalf in connection with covered accounts of Covered Entity agrees to implement reasonable policies and procedures designed to detect, prevent, and mitigate the risk of identity theft; and (d) alerting Covered Entity of any red flag incident (as defined by the Red Flag Rules) of which it becomes aware, the steps it has taken to mitigate any potential harm that may have occurred, and provide a report to Covered Entity of any threat of identity theft as a result of the incident. Cc. Permitted Uses and Disclosures by Business Associate The specific uses and disclosures of PHI that may be made by Business Associate on behalf of Covered Entity include: 1. Exhibit A The review of patient care information for providing advice to Covered Entity concerning a particular ambulance incident; The review of patient care information and other medical records and submission of that information to carriers, insurers, and other payers and assisting Covered Entity in an insurance or Medicare audit or other similar action; and Page 3 of 4 3. Other uses or disclosures of PHI as permitted by HIPAA necessary to perform the services that Business Associate has been engaged to perform on behalf of Covered Entity. D. Termination 1. Exhibit A Covered Entity may terminate this Agreement if Covered Entity determines that Business Associate has violated a material term of the Agreement. If either party knows of a pattern of activity or practice of the other party that constitutes a material breach or violation of the other party’s obligations under this Agreement, that party shall take reasonable steps to cure the breach or end the violation, as applicable, and, if such steps are unsuccessful, terminate the Agreement, if feasible. Upon termination of this Agreement for any reason, Business Associate shall return to Covered Entity or destroy all PHI received from Covered Entity, or created, maintained, or received by Business Associate on behalf of Covered Entity that Business Associate still maintains in any form. Business Associate shall retain no copies of the PHI. If return or destruction is infeasible, the protections of this Agreement will extend to such PHI. Page 4 of 4