SCHEDULE D HIPPA BUSINESS PARTNER AGREEMENT

Transcription

1 SCHEDULE D HIPPA BUSINESS PARTNER AGREEMENT Whereas, the DPB, hereinafter the Covered Entity, as that term is defined by the Health Insurance Portability and Accountability Act of 1996, 42 U.S.C.A et seq. ( HIPAA ) and regulations promulgated by the U.S. Department of Health and Human Services (the HIPAA Regulations ), will be disclosing certain information to the Contractor, hereinafter Business Associate, as that term is defined by HIPAA and the HIPAA Regulations, which may also otherwise be receiving or creating certain information on behalf of the Covered Entity, pursuant to the Contract, some of which might constitute Protected Health Information ( PHI ); and Whereas, the Covered Entity and the Business Associate must protect the privacy and provide for the security of PHI disclosed to Business Associate pursuant to the Contract in compliance with the HIPAA and the HIPAA Regulations and other applicable laws; and Whereas, the purpose of this Schedule D is to satisfy certain standards and requirements of HIPAA and the HIPAA Regulations, including but not limited to those contained in Title 45, (e) of the Code of Federal Regulations ( CFR ), as the same may be amended from time to time; NOW THEREFORE, in consideration of the mutual promises below and the exchange of information pursuant to this Addendum, the Covered Entity and Business Associate agree as follows: ARTICLE I - DEFINITIONS{ TC \l1 "} Terms used, but not otherwise defined, in the Contract shall have the same meaning as those terms in 45 CFR and Business Associate shall mean the Contractor. Covered Entity shall mean the Division of Pensions and Benefits. Data Aggregation shall have the meaning given to such term under the Privacy Rule, including but not limited to 45 CFR Designated Record Set shall have the meaning given to such term under the Privacy Rule, including but not limited to 45 CFR Health Care Operations shall have the meaning given to such term under the Privacy Rule, including but not limited to 45 CFR Individual shall have the meaning given to such term in 45 CFR and shall include a person who qualifies as a personal representative in accordance with 45 CFR (g) Privacy Rule shall mean the HIPAA Regulation that is codified at 45 CFR Parts 160 and part 164, sub parts A and E. Page 1 of 6 Pages

2 Protected Health Information or PHI shall have the same meaning as the term protected health information in 45 CFR , limited to the information created or received by Business Associate from or on behalf of Covered Entity. Required by Law shall have the meaning given to such term in 45 CFR Secretary shall mean the Secretary of the federal Department of Health and Human Services or his designee. ARTICLE II OBLIGATIONS OF BUSINESS ASSOCIATE{ TC \l1 "} A. Permitted Uses and Disclosures. Business Associate may use or disclose PHI received by Business Associate from the Covered Entity as may be necessary to complete its obligations under the Contract, as agreed in writing to by the State Contract Manager. B. Nondisclosure. Business Associate shall not use or further disclose the Covered Entity s PHI otherwise than as permitted or required by the Contract or as required by law. C. Safeguards. Business Associate shall implement appropriate safeguards as are necessary to prevent the use or disclosure of PHI other than as permitted by the Contract. Business Associate shall maintain a comprehensive written information privacy and security program that includes administrative, technical and physical safeguards appropriate to the size and complexity of the Business Associate s operations and the nature and scope of its activities. D. Duty to Mitigate. Business Associate agrees to mitigate, to the extent practicable, any harmful effect that is known to Business Associate of a use or disclosure of PHI by Business Associate in violation of the Contract. E. Reporting of Improper Use or Disclosure. Business Associate shall report to the Covered Entity in writing any use or disclosure of the Covered Entity s PHI other than as permitted or required by the Contract, within two business days of Business Associate becoming aware of such use or disclosure. F. Business Associate s Agents. Business Associate shall ensure that any agents, including subcontractors to whom it provides PHI, agree in writing to the same restrictions and conditions that apply to Business Associate with respect to such PHI. G. Internal Practices. If requested, Business Associate shall make its internal practices, books and records, including policies and procedures, relating to the use and disclosure of PHI received from, or created or received by, the Business Associate on behalf of the Covered Entity available to the Secretary of the U.S. Department of Health and Human Services for purposes of determining the Business Associate s compliance with the Privacy Rule. H. Availability of PHI to Covered Entity. Business Associate shall make available to the Covered Entity such information as the Covered Entity may require to satisfy the Covered Page 2 of 6 Pages

3 Entity s obligations to provide access to, provide a copy of, and account for disclosures with respect to PHI pursuant to the Privacy Regulations. I. Minimum Necessary. Business Associate and its agents or subcontractors shall only request, use and disclose the minimum amount of PHI necessary to accomplish the purpose of the request, use or disclosure. J. Notification of Breach. During the term of the Contract, the Business Associate shall notify the Covered Entity promptly of any breach of security, intrusion or unauthorized use or disclosure of PHI or any actual or use or disclosure of data in violation of any applicable federal or state laws or regulations. Business Associate shall take (i) prompt corrective action to cure any such deficiencies and (ii) any action pertaining to such unauthorized disclosure required by applicable federal and state laws and regulations. K. Audits, Inspection and Enforcement. Upon notice of a material breach of any of the terms of this Schedule D, the Covered Entity, or its authorized agents or contractors, has the right upon reasonable notice to the Business Associate, to inspect the facilities, systems, books and records of the Business Associate. Business Associate shall promptly remedy any violation of any term of this Schedule D and shall certify the same to the Covered Entity in writing. The fact that the Covered Entity or its designee, inspects, or fails to inspect, or has the right to inspect, the Business Associate s facilities, systems and procedures does not relieve the Business Associate of its responsibility to comply with this Schedule D, nor does the Covered Entity s (i) failure to detect or (ii) detection, but failure to notify the Business Associate or require the Business Associate s remediation of any unsatisfactory practices, constitute acceptance of such practice or a waiver of the Covered Entity s enforcement under this Schedule D. Nothing in this paragraph is deemed to waive the provisions of the New Jersey Tort Claims Act, 59:1-1 et seq. as they apply to the Covered Entity. ARTICLE III- OBLIGATIONS OF COVERED ENTITY{ TC \l1 "} A. Safeguards. The Covered Entity shall be responsible for using appropriate safeguards to maintain and ensure the confidentiality, privacy and security of PHI transmitted to the Business Associate pursuant to the Contract, in accordance with the standards and requirements of the Privacy Rule. ARTICLE IV - TERMINATION{ TC \l1 "} A. Term. The effective date of this Schedule D shall be the effective date of the Contract and it shall terminate following Contract termination and when all PHI provided by the Covered Entity to the Business Associate, or created or received by the Business Associate on behalf of the Covered Entity, is destroyed or returned to the Covered Entity. { TC \l2 "} B. Material Breach. A breach by the Business Associate of any material provision of this Schedule D, as determined by the Covered Entity, shall constitute a material breach of the Contract and shall provide grounds for termination of the Contract by the Covered Entity pursuant to the termination provisions of the Contract. Page 3 of 6 Pages

4 C. Reasonable Steps to Cure Breach. If the Covered Entity knows of a pattern of activity or practice of the Business Associate that constitutes a material breach or violation of the Business Associate s obligations under the provisions of this Schedule D and does not terminate the Contract, then the Covered Entity shall provide the Business Associate time to take reasonable steps to cure such breach or end such violation, as applicable. If the Business Associate s efforts to cure such breach or end such violation within the time accorded by the Covered Entity, are unsuccessful, the Covered Entity shall either (i) terminate the Contract, if feasible, or (ii) if termination of the Contract is not feasible, then the Covered Entity shall report the Business Associate s breach or violation to the Secretary of the federal Department of Health and Human Services. D. Judicial or Administrative Proceedings. Covered Entity may terminate the Contract, effective immediately, if (i) the Business Associate is named as a defendant in a criminal proceeding for a violation of HIPAA or other security or privacy laws or (ii) a finding or stipulation that the Business Associate has violated any standard or requirement of HIPAA or other security or privacy laws is made in any administrative or civil proceeding in which the Business Associate has been joined. E. Effect of Termination. Upon termination of the Contract for any reason, the Business Associate shall return or destroy all PHI that the Business Associate or its agents or subcontractors still maintain in any form, and shall retain no copies of such PHI. The Business Associate shall certify in writing to the Covered Entity that such PHI has been destroyed. ARTICLE V - DISCLAIMER{ TC \l1 "} Covered Entity makes no warranty or representation that compliance by the Business Associate with this Schedule D, HIPAA, or the Privacy Rule will be adequate or satisfactory for the Business Associate s own purposes. Business Associate is solely responsible for all decisions made by the Business Associate regarding the safeguarding of PHI. ARTICLE VI - AMENDMENT{ TC \l1 "} A. Amendment to Comply with Law. The parties agree to take such action as is necessary to amend this Schedule D from time to time as is necessary for the Covered Entity to comply with the requirements of the Privacy Rule. The parties understand and agree that the Covered Entity must receive satisfactory written assurance from the Business Associate that the Business Associate will adequately safeguard all PHI that it receives or creates pursuant to the Contract. Upon the Covered Entity s request, the Business Associate agrees to promptly enter into negotiations with the Covered Entity concerning the terms of an amendment to this Schedule D embodying written assurances consistent with the standards and requirements of the Privacy Rule. The Covered Entity may terminate the Contract for cause, as provided in the Contract, in the event (i) the Business Associate does not promptly enter into negotiations to amend this Schedule D when requested by the Covered Entity pursuant to this Section or (ii) the Business Associate does not enter into an amendment to this Schedule D providing assurances regarding the safeguarding of PHI that the Covered Page 4 of 6 Pages

5 Entity deems sufficient to satisfy the standards and requirements of HIPAA and the HIPAA Regulations. { TC \l1 "} ARTICLE VII ASSISTANCE IN LITIGATION OR ADMINISTRATIVE PROCEEDINGS{ TC \l1 "} Business Associate shall make itself, and any subcontractors, employees or agents assisting the Business Associate in the performance of its obligations under the Contract, available to the Covered Entity, to testify as witnesses, or otherwise, in the event of litigation or administrative proceedings being commenced against the Covered Entity, its officers or employees based upon a claimed violation of HIPAA, the Privacy Rule or other laws relating to security and privacy, except where the Business Associate or its subcontractor, employee or agent is a named adverse party. ARTICLE VIII - NO THIRD PARTY BENEFICIARIES{ TC \l1 "} Nothing express or implied in this Schedule D is intended to confer, nor shall anything herein confer, upon any person other than the Covered Entity, the Business Associate and their respective successors or assigns, any rights, remedies, obligations or liabilities whatsoever. { TC \l1 "} ARTICLE IX EFFECT ON AGREEMENT{ TC \l1 "} All terms of the Contract shall remain in force and effect except where they might conflict with the terms of this Schedule D and then the terms of this Schedule D shall control. { TC \l1 "} ARTICLE X - INTERPRETATION{ TC \l1 "} This Schedule D shall be interpreted as broadly as necessary to implement and comply with HIPAA, the Privacy Rule and applicable state laws. The Parties agree that any ambiguity in this Schedule D shall be resolved in favor of a meaning that complies and is consistent with HIPAA and the Privacy Rule. ARTICLE XI - INDEMNIFICATION Business Associate shall indemnify the Covered Entity from and against claims, demands, suits, actions, recoveries, judgments and costs (including reasonable attorney fees and costs and court costs) in connection therewith on account of loss of life, property or injury or damages to the person, body or property of a person or persons, whatsoever, which shall result directly from the Business Associate's misuse of PHI or from any action or inaction of the Business Associate or its officers, employees, agents or contractors with regard to PHI or the requirements of this Schedule D or the Privacy Rule which is in violation of the Privacy Rule or in breach of this Schedule D. The provisions of this Article shall in no way limit the obligations assumed by the Business Associate or the Covered Entity under this Schedule D, nor shall they be construed to Page 5 of 6 Pages

6 relieve either Party from any liability nor preclude either Party from taking any other actions available to it under any other provisions of this Schedule D, the Privacy Rule or other law. Notwithstanding the above, the obligations assumed by the Business Associate herein shall not extend to or encompass claims, demands, suits, actions, recoveries, judgments and costs (including reasonable attorney fees and costs) incurred as a result of actions or inactions of the Covered Entity or others. The Covered Entity shall be responsible for its own defense of any and all claims arising out of or in connection with its own act or omission, or that of its employees, agencies, or contractors, in the performance of its obligations under this Schedule D and the Privacy Rule. The obligations under this Article shall survive the termination of the Contract. ARTICLE XII - NOTICES Whenever, under the terms of this Addendum, written notice is required it shall be given in accordance with Section 28 of Schedule A. Page 6 of 6 Pages