Okaloosa County BOCC — November 18, 2014 — PENN CREDIT CONTRACT — reading text

“Breach” of unsecured PHI or lead to a “Breach” of unsecured PHI. Page | 10 BUSINESS ASSOCIATE shall be defined as provided in 45 CFR Sections160.103. Generally, a Business Associate means a person who, on behalf of a covered entity, creates, receives, maintains, or transmits PHI or provides legal, actuarial, accounting, consulting, data aggregation, management, administrative, accreditation, or financial services to or for a covered entity. A covered entity may be a business associate of another covered entity. A business associate includes, among other things, a person that offers a personal health record to one or more individuals on behalf of a covered entity and/or a subcontractor who creates, receives, maintains, or transmits PHI on behalf of the business associate. Capitalized terms used, but not otherwise defined, in this Agreement shall have the same meaning as those terms in HIPAA, HIPAA Regulations and HITECH. Obligations and Activities of Business Associate Privacy Use or Disclosure. Business Associate agrees not to use or disclose PHI in violation of this Agreement or the Privacy Rule. Business Associate agrees to comply with the requirements of 45 CFR Section 164.502 and shall use and disclose PHI obtained pursuant to this Agreement in compliance with each requirement of 45 CFR §164.502, Prohibited Payment for PHI. Business Associate agrees not to directly or indirectly receive payment in exchange for any PHI, unless Covered Entity obtained from the individual, who is the subject of the PHI, a signed written authorization specifically stating that the PHI can be exchanged for payment, or otherwise permitted by the limited exceptions as provided in HITECH §13405(d). Mitigation. Business Associate agrees to mitigate, to the extent reasonably possible, any harmful effect that is known to Business Associate from any use or disclosure of PHI by Business Associate that is not authorized by this Agreement. Business Associate further agrees to mitigate, to the extent reasonably possible, any harmful effect that is known to Business Associate from any Security Incident or, after a reasonable investigation, would be known to Business Associate, Subcontractors and Agents. Business Associate may disclose protected health information to a business associate that is a subcontractor and may allow the subcontractor to create, receive, maintain, or transmit PHI on its behalf, if the business associate obtains satisfactory assurances, in accordance with 45 CFR §164.504(e)(1)(), that the subcontractor will appropriately safeguard the information by imposing, at a minimum, the same restrictions and conditions that apply through this Agreement to Business Associate with respect to such information. Audit/Inspection. Business Associate agrees to make internal practices, books, and records, including policies and procedures and PHI, relating to the use and disclosure of PHI received from, or created or received by Business Associate on behalf of Covered Entity, available to the Covered Entity or the Secretary of Health and Human Services or his/her designee in a timely manner for purposes of the Secretary determining Covered Entity's compliance with the Privacy Rule. Access. Business Associate agrees to provide timely access, when requested by Covered Entity, to PHI in a Designated Record Set (if PHI is maintained in a Designated Record Set) to Covered Entity or an individual for purposes of compliance with 45 CFR §164.526 and Covered Entity’s policies. Amendment. Provided Business Associate maintains PHI in a Designated Record Set, Business Associate agrees to make any amendment(s) to PHI in a Designated Record Set that Covered Entity Page | 11 1 { 1 directs or agrees to pursuant to 45 CFR 164.526 and Covered Entity’s policies in the time and manner directed by Covered Entity at the request of Covered Entity or an Individual. ¢ Documentation of Disclosures. Business Associate agrees to document such disclosures of PHI and information related to such disclosures as would be required for Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164,528 and Covered Entity’s policies . * Accounting. Business Associate agrees to provide to Covered Entity or an Individual, in a timely manner, information collected in accordance with this Agreement to permit Covered Entity to respond to a request by an Individual for an accounting of disclosures of PHI in accordance with 45 CFR § 164.528. ° Compliance with Security Rule. Business Associate agrees to comply with the requirements of the security rule (45 CFR§§164.308, 164.310 & 164.316) in the same manner that such sections apply to Covered Entity. e Security Rule. Business Associate agrees to implement administrative, physical, and technical safeguards that reasonably and appropriately protect Electronic Protected Health Information, as required by the Security Rule. Any Business Associate agent or subcontractor will also implement such safeguards. Business Associate agrees to conduct a risk assessment and implement reasonable administrative, technical, and physical safeguards designed to protect both Covered Entity’s PHI and other business and other proprietary information from unauthorized disclosure. Business Associate agrees to update the risk assessment and related safeguards at least annually. Upon request by Covered Entity, Business Associate agrees to provide documentation sufficient to demonstrate its compliance with the terms of this Agreement. e HITECH Compliance. Business Associate agrees to comply with all aspects of HITECH. ¢ Reporting Security Incidents & Breaches. Business Associate agrees to report to Covered Entity any Security Incident of which it becomes aware, including any Breach of unsecured PHI as required by 45 CFR §164.410. Business Associate shall make this report to the Covered Entity within 2 business days after it becomes aware of the Security Incident and/or Breach, and Business Associate shall be deemed to have knowledge of a Security Incident and/or a Breach if the relevant facts are known, or by exercising reasonable diligence would have been known, to any person, other than the person committing the Security Incident/Breach, who is an employee, officer, or other agent of the business associate. * Information Provided to Covered Entity. Business Associate shall provide to the Covered Entity, to the extent possible, the identification of each individual whose unsecured PHI has been, or is reasonably believed by Business Associate to have been, accessed, acquired, used, or disclosed during the Security Incident and/or Breach. Business Associate shall provide to the Covered Entity with a brief description of the breach, a description of the unsecured PHI involved, steps individuals should take to protect themselves from potential harm, a description of Business Associate’s investigation and mitigation of the Breach, and Business Associate’s contact information for individuals to access information and/or ask questions. In addition, Business Associate shall provide the Covered Entity with any other available information that the Covered Entity is required to include in notification to the individual under 45 CFR §164.404(c) or as soon thereafter as information becomes available, ¢ Business Associate agrees within thirty (30) days of receipt of documentation from Covered Entity to reimburse Covered Entity for any and all reasonable expenses including (without limitation) cost of Page | 12 mailing, media, and credit monitoring incurred by Covered Entity in carrying out its obligations under HIPAA Regulations to notify individuals affected by a Breach by Business Associate. Permitted Uses and Disclosures by Business Associate Except as otherwise limited in this Agreement, Business Associate may use or disclose PHI to perform functions, activities, or services for, or on behalf of, Covered Entity as specified in the Contract hereto, which may be amended in writing and signed by the parties, provided that such use or disclosure would not violate HIPAA, HIPAA Regulations, HITECH or the policies and procedures of Covered Entity if done by Covered Entity. Business Associate may use PHI to meet its legal obligations or in the management or administration of its business provided such use is not otherwise contrary to the terms of this Agreement or would not violate HIPAA, HIPAA Regulations, HITECH or the policies and procedures of Covered Entity if done by Covered Entity. Obligations of Covered Entity Covered Entity shall notify Business Associate of any limitation(s) in its notice of privacy practices of Covered Entity in accordance with 45 CFR § 164.520, to the extent that such limitation may affect Business Associate's use or disclosure of PHI. Covered Entity shall notify Business Associate of any changes in, or revocation of, permission by an individual to use or disclose PHI, to the extent that such changes may affect Business Associate's use or disclosure of PHI. Covered Entity shall not request Business Associate to use or disclose PHI] in any manner that would not be permissible under HIPAA, HIPAA Regulations, HITECH or this Agreement. Term and Termination Term. This Agreement shall be effective as of November 18, 2014, and shall terminate when all of the PHI provided by Covered Entity to Business Associate, or created or received by Business Associate on behalf of Covered Entity, is destroyed or returned to Covered Entity, or, if it is infeasible to return or destroy PHI, protections are extended to such information, in accordance with the termination provisions in this Section. Termination by Covered Entity for Cause. Upon Covered Entity's knowledge of a material breach by Business Associate, Covered Entity shall provide an opportunity for Business Associate to cure the breach or end the violation and terminate this Agreement if Business Associate does not cure the breach or end the violation within the time specified by Covered Entity. If neither termination nor cure is feasible, Covered Entity shall report the violation to the Secretary of Health & Human Services (HHS). Termination by Business Associate for Cause. Upon Business Associate’s knowledge of a violation by Covered Entity of the Privacy Rule, Business Associate shall terminate this Agreement for cause or notify HHS of such violation. Page | 13 e =6Effect of Termination. 1. Upon termination of this Agreement, for any reason, Business Associate shall return or destroy all PHI received from Covered Entity, or created or received by Business Associate on behalf of Covered Entity. This provision shall also apply to PHI that is in the possession of subcontractors or agents of Business Associate. Business Associate shall retain no copies of the PHI. 2. In the event that Business Associate determines that returning or destroying the PHI is infeasible, Business Associate shall provide to Covered Entity notification of the conditions that make return or destruction infeasible. Upon agreement by the parties that return of or destruction of PHI is not feasible, Business Associate shall extend the protections of this Agreement to such PHI and limit further uses and disclosures of such PHI to those purposes that make the return or destruction infeasible, for so long as Business Associate maintains such PHI. Miscellaneous e Amendment. The Parties agree to take such action to amend this Agreement from time to time as is necessary for Covered Entity or Business Associate to comply with the rules and requirements of applicable law(s) protecting the privacy, security and confidentiality of PHI including but not limited to HIPAA, HIPAA Regulations, and HITECH and any regulations later promulgated relating to HITECH. e Notices. All required notices shall be in writing and shall be hand delivered or given by certified or registered mail to the addresses